Tools / This week4 October 2026 – 11 October 2026
This week in CVEs
In the last seven days 3,085 CVEs were published, 358 of them critical. 5 were added to CISA’s known-exploited list, and 39 saw their EPSS exploitation probability jump. 6 KEV deadlines fall in the coming week.
Critical
358
High
1,102
Medium
1,227
Low
160
Not yet scored
238
RSS feed ↗Only for my products →Refreshed daily · rolling seven days
Added to CISA KEV this week
Vulnerabilities CISA confirmed are being exploited in the wild. If any of these is in your estate it is an emergency change, and the due date is the latest anyone should tolerate.
| CVE | Summary | Affects | Priority | Added |
|---|---|---|---|---|
| CVE-2015-3306 | ProFTPD Improper Access Control Vulnerability | fedoraproject/fedora · debian/debian linux · opensuse/tumbleweed +2 | KEVEXPLOIT ×4 ✓CRITICAL 10.0EPSS 99.5% | 8 October 2026 |
| CVE-2015-5477 | ISC BIND Data Processing Errors Vulnerability | juniper/junos · fedoraproject/fedora · redhat/enterprise linux +18 | KEVEXPLOIT ×2 ✓HIGH 7.5EPSS 99.4% | 8 October 2026 |
| CVE-2016-3081 | Apache Struts Command Injection Vulnerability | huawei/agile controller-campus firmware · huawei/anyoffice · huawei/logcenter +17 | KEVEXPLOIT ✓HIGH 8.1EPSS 96.1% | 8 October 2026 |
| CVE-2021-3199 | ONLYOFFICE Docs Server Path Traversal Vulnerability | onlyoffice/document server | KEVCRITICAL 9.8EPSS 19.4% | 8 October 2026 |
| CVE-2023-22894 | Strapi Cleartext Storage of Sensitive Information Vulnerability | strapi/strapi | KEVMEDIUM 4.9EPSS 3.61% | 8 October 2026 |
KEV deadlines in the coming week
Full calendar →| CVE | Summary | Affects | Priority | Due |
|---|---|---|---|---|
| CVE-2015-3306 | ProFTPD Improper Access Control Vulnerability | fedoraproject/fedora · debian/debian linux · opensuse/tumbleweed +2 | KEVEXPLOIT ×4 ✓CRITICAL 10.0EPSS 99.5% | 11 October 2026 |
| CVE-2015-5477 | ISC BIND Data Processing Errors Vulnerability | juniper/junos · fedoraproject/fedora · redhat/enterprise linux +18 | KEVEXPLOIT ×2 ✓HIGH 7.5EPSS 99.4% | 11 October 2026 |
| CVE-2016-3081 | Apache Struts Command Injection Vulnerability | huawei/agile controller-campus firmware · huawei/anyoffice · huawei/logcenter +17 | KEVEXPLOIT ✓HIGH 8.1EPSS 96.1% | 11 October 2026 |
| CVE-2021-3199 | ONLYOFFICE Docs Server Path Traversal Vulnerability | onlyoffice/document server | KEVCRITICAL 9.8EPSS 19.4% | 11 October 2026 |
| CVE-2023-22894 | Strapi Cleartext Storage of Sensitive Information Vulnerability | strapi/strapi | KEVMEDIUM 4.9EPSS 3.61% | 11 October 2026 |
| CVE-2026-86950 | Apple Multiple Products Out-of-Bounds Write Vulnerability | apple/ipados · apple/iphone os · apple/macos | KEVHIGH 8.8EPSS 1.24% | 13 October 2026 |
New public exploits
CVEs that gained their first public exploit in Exploit-DB this week. A published exploit removes the skill barrier; these tend to appear in scanning traffic within days.
No CVE gained its first public exploit this week.
EPSS jumps
CVEs whose EPSS score rose by five points or more, or crossed the ten per cent line, in the last seven days. A jump usually means a public exploit or a scanning campaign appeared.
| CVE | Summary | EPSS | Priority | When |
|---|---|---|---|---|
| CVE-2026-50751 | Check Point Security Gateway Improper Authentication Vulnerabilitycheckpoint/gaia os · checkpoint/gaia embedded | 6.4% → 85.3% | KEVCRITICAL 9.3EPSS 85.3% | 8 October 2026 |
| CVE-2026-73570 | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerabilitysynacor/zimbra collaboration suite | 11.9% → 71.7% | KEVHIGH 8.9EPSS 71.7% | 6 October 2026 |
| CVE-2026-55040 | Microsoft SharePoint Weak Authentication Vulnerabilitymicrosoft/sharepoint server | 17.5% → 69.5% | KEVCRITICAL 9.1EPSS 69.5% | 5 October 2026 |
| CVE-2026-66066 | In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. | 2.1% → 27.9% | CRITICAL 9.5EPSS 27.9% | 8 October 2026 |
| CVE-2026-0768 | Langflow code Code Injection Remote Code Execution Vulnerability.langflow/langflow | 8.5% → 23.2% | CRITICAL 9.8EPSS 23.2% | 9 October 2026 |
| CVE-2025-54988 | Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF.apache/tika | 36.7% → 48.5% | HIGH 8.4EPSS 48.5% | 10 October 2026 |
| CVE-2024-32030 | Kafka UI API allows users to connect to different Kafka brokers by specifying their network address and port. | 39.4% → 51.1% | HIGH 8.1EPSS 51.1% | 10 October 2026 |
| CVE-2008-6347 | PHP remote file inclusion vulnerability in lib/onguma.class.php in the Onguma Time Sheet (com_ongumatimesheet20) 2.0 4b component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.luigi massa/onguma time sheet | 19.9% → 31.1% | EXPLOIT ✓HIGH 7.5EPSS 31.1% | 9 October 2026 |
| CVE-2025-34035 | An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier.engeniustech/esr300 firmware · engeniustech/esr350 firmware · engeniustech/esr600 firmware | 12.5% → 22.8% | CRITICAL 10.0EPSS 22.8% | 7 October 2026 |
| CVE-2009-1551 | Multiple PHP remote file inclusion vulnerabilities in Qt quickteam 2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) qte_web_path parameter to qte_web.php and the (2) qte_root parameter to bin/qte_init.php.qt-cute/quickteam | 27.0% → 36.6% | EXPLOIT ✓HIGH 7.5EPSS 36.6% | 6 October 2026 |
| CVE-2026-0769 | Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability.langflow/langflow | 32.3% → 41.7% | CRITICAL 9.8EPSS 41.7% | 9 October 2026 |
| CVE-2025-57791 | A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation.commvault/commvault | 25.1% → 34.4% | MEDIUM 6.9EPSS 34.4% | 10 October 2026 |
| CVE-2025-7441 | The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. | 40.9% → 50.1% | EXPLOITCRITICAL 9.8EPSS 50.1% | 6 October 2026 |
| CVE-2010-20103 | A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010.proftpd/proftpd | 5.1% → 13.7% | CRITICAL 9.3EPSS 13.7% | 10 October 2026 |
| CVE-2025-47981 | Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to execute code over a network.microsoft/windows 10 1507 · microsoft/windows 10 1607 · microsoft/windows 10 1809 | 32.7% → 41.1% | CRITICAL 9.8EPSS 41.1% | 9 October 2026 |
| CVE-2015-5477 | ISC BIND Data Processing Errors Vulnerabilityjuniper/junos · fedoraproject/fedora · redhat/enterprise linux | 91.8% → 99.4% | KEVEXPLOIT ×2 ✓HIGH 7.5EPSS 99.4% | 10 October 2026 |
| CVE-2025-57790 | A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue.commvault/commvault | 19.4% → 27.0% | HIGH 8.7EPSS 27.0% | 10 October 2026 |
| CVE-2025-15472 | This manipulation of the argument DeviceURL causes os command injection.trendnet/tew-811dru firmware | 22.4% → 29.6% | HIGH 7.3EPSS 22.4% | 7 October 2026 |
| CVE-2025-15029 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user.centreon/awie | 5.8% → 13.0% | CRITICAL 9.8EPSS 13.0% | 8 October 2026 |
| CVE-2025-47984 | Protection mechanism failure in Windows GDI allows an unauthorized attacker to disclose information over a network.microsoft/windows 10 1507 · microsoft/windows 10 1607 · microsoft/windows 10 1809 | 16.9% → 23.3% | HIGH 7.5EPSS 23.3% | 9 October 2026 |
| CVE-2021-3199 | ONLYOFFICE Docs Server Path Traversal Vulnerabilityonlyoffice/document server | 8.2% → 14.5% | KEVCRITICAL 9.8EPSS 19.4% | 9 October 2026 |
| CVE-2019-1002100 | In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type:…kubernetes/kubernetes · redhat/openshift container platform | 10.7% → 16.9% | MEDIUM 6.5EPSS 16.9% | 10 October 2026 |
| CVE-2026-77692 | An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. | 0.7% → 6.6% | HIGH 7.5EPSS 6.56% | 5 October 2026 |
| CVE-2023-3079 | Google Chromium V8 Type Confusion Vulnerabilitygoogle/chrome · fedoraproject/fedora · debian/debian linux | 32.1% → 37.9% | KEVHIGH 8.8EPSS 37.9% | 9 October 2026 |
| CVE-2025-47228 | In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows authenticated attackers to execute system commands via crafted HTTP requests. | 17.5% → 23.1% | EXPLOITMEDIUM 6.7EPSS 23.1% | 6 October 2026 |
| CVE-2026-29058 | Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter.wwbn/avideo-encoder | 1.6% → 6.8% | CRITICAL 9.8EPSS 6.77% | 6 October 2026 |
| CVE-2024-54146 | Cacti has a SQL injection vulnerability in the template function of host_templates.php using the graph_template parameter.cacti/cacti | 41.0% → 46.1% | HIGH 8.8EPSS 46.1% | 5 October 2026 |
| CVE-2025-7083 | A vulnerability was found in Belkin F9K1122 1.00.33.belkin/f9k1122 firmware | 41.2% → 46.3% | LOW 2.1EPSS 46.3% | 7 October 2026 |
| CVE-2026-61450 | Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or anyone able to write to user/pages) to exfiltrate configuration secrets. | 0.4% → 5.4% | HIGH 7.1EPSS 5.42% | 9 October 2026 |
| CVE-2020-28901 | Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in cmd_subsys.php.nagios/fusion | 9.1% → 11.9% | CRITICAL 9.8EPSS 11.9% | 10 October 2026 |
| CVE-2018-1297 | This could allow an attacker to get Access to JMeterEngine and send unauthorized code.apache/jmeter | 9.9% → 11.4% | CRITICAL 9.8EPSS 11.4% | 8 October 2026 |
| CVE-2025-9533 | A vulnerability has been found in TOTOLINK T10 4.1.8cu.5241_B20210927.totolink/t10 firmware | 9.4% → 10.8% | MEDIUM 5.5EPSS 10.8% | 5 October 2026 |
| CVE-2026-2080 | A vulnerability has been found in UTT HiPER 810 1.7.4-141218.utt/810 firmware | 9.9% → 10.8% | HIGH 7.3EPSS 10.8% | 5 October 2026 |
| CVE-2021-1678 | Windows Print Spooler Spoofing Vulnerabilitymicrosoft/windows 10 · microsoft/windows 7 · microsoft/windows 8.1 | 9.3% → 10.0% | HIGH 8.8EPSS 10.0% | 7 October 2026 |
| CVE-2025-44176 | Tenda FH451 V1.0.0.9 is vulnerable to Remote Code Execution in the formSafeEmailFilter function.tenda/fh451 firmware | 9.9% → 10.6% | MEDIUM 6.5EPSS 10.6% | 8 October 2026 |
| CVE-2021-29425 | In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not…apache/commons io · debian/debian linux · oracle/access manager | 9.9% → 10.5% | MEDIUM 4.8EPSS 10.5% | 8 October 2026 |
| CVE-2015-6830 | libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a…phpmyadmin/phpmyadmin | 9.8% → 10.4% | EXPLOITMEDIUM 5.0EPSS 10.4% | 5 October 2026 |
| CVE-1999-1588 | Buffer overflow in nlps_server in Sun Solaris x86 2.4, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code as root via a long string beginning with "NLPS:002:002:" to the listen (aka System V listener) port, TCP port 2766.sun/solaris | 9.9% → 10.1% | EXPLOIT ✓CRITICAL 9.8EPSS 10.1% | 8 October 2026 |
| CVE-2016-4555 | client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.squid-cache/squid · canonical/ubuntu linux · oracle/linux | 53.9% → 18.2% | HIGH 7.5EPSS 18.2% | 6 October 2026 |
New critical CVEs, most likely exploited first
The 358 critical-severity CVEs published this week, ordered by EPSS. The top of this list is where a patch cycle should start when nothing above applies.
| CVE | Summary | Affects | Priority | Published |
|---|---|---|---|---|
| CVE-2026-105110 | OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter. | — | CRITICAL 9.3EPSS 2.79% | 8 October 2026 |
| CVE-2026-105484 | A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. | — | CRITICAL 10.0EPSS 2.13% | 6 October 2026 |
| CVE-2026-107780 | Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. | — | CRITICAL 9.3EPSS 2.06% | 8 October 2026 |
| CVE-2026-91140 | An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to… | — | CRITICAL 9.6EPSS 1.92% | 6 October 2026 |
| CVE-2026-106126 | A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe. | — | CRITICAL 9.4EPSS 1.88% | 8 October 2026 |
| CVE-2026-107703 | @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. | — | CRITICAL 9.3EPSS 1.85% | 8 October 2026 |
| CVE-2026-21589 | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. | — | CRITICAL 9.3EPSS 1.77% | 5 October 2026 |
| CVE-2026-107704 | The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. | — | CRITICAL 9.3EPSS 1.66% | 8 October 2026 |
| CVE-2026-107699 | ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. | — | CRITICAL 9.3EPSS 1.47% | 8 October 2026 |
| CVE-2026-107459 | The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. | — | CRITICAL 9.3EPSS 1.47% | 8 October 2026 |
| CVE-2026-104711 | Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. | apache/struts | CRITICAL 9.8EPSS 1.19% | 5 October 2026 |
| CVE-2026-105794 | MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. | — | CRITICAL 9.1EPSS 1.00% | 6 October 2026 |
| CVE-2026-105793 | The adb client joins the arguments into a remote command string that the Android shell reparses, allowing an authenticated Mobile MCP caller to execute additional commands as the Android shell user on an authorized connected device. | — | CRITICAL 9.1EPSS 0.86% | 6 October 2026 |
| CVE-2026-88131 | Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network. | — | CRITICAL 9.8EPSS 0.84% | 8 October 2026 |
| CVE-2026-82531 | Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. | — | CRITICAL 9.2EPSS 0.82% | 6 October 2026 |
| CVE-2026-63688 | Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. | dell/container storage modules | CRITICAL 10.0EPSS 0.79% | 6 October 2026 |
| CVE-2026-105284 | A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. | — | CRITICAL 9.3EPSS 0.78% | 5 October 2026 |
| CVE-2026-107202 | A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. | — | CRITICAL 9.1EPSS 0.78% | 7 October 2026 |
| CVE-2026-107204 | LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. | — | CRITICAL 9.3EPSS 0.77% | 7 October 2026 |
| CVE-2026-93674 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | langflow/langflow | CRITICAL 9.8EPSS 0.77% | 7 October 2026 |
| CVE-2026-104801 | The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it… | — | CRITICAL 9.1EPSS 0.76% | 10 October 2026 |
| CVE-2026-93675 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion. | langflow/langflow | CRITICAL 9.8EPSS 0.75% | 7 October 2026 |
| CVE-2026-103889 | The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. | — | CRITICAL 9.8EPSS 0.74% | 10 October 2026 |
| CVE-2026-37719 | An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component. | — | CRITICAL 9.8EPSS 0.74% | 5 October 2026 |
| CVE-2026-32568 | Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions. | — | CRITICAL 9.9EPSS 0.74% | 6 October 2026 |
| CVE-2026-103663 | Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. | — | CRITICAL 9.4EPSS 0.71% | 8 October 2026 |
| CVE-2026-106037 | Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. | — | CRITICAL 9.3EPSS 0.70% | 6 October 2026 |
| CVE-2026-77226 | Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin… | — | CRITICAL 9.2EPSS 0.69% | 5 October 2026 |
| CVE-2026-9209 | mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing… | — | CRITICAL 9.3EPSS 0.69% | 8 October 2026 |
| CVE-2026-82989 | There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints | — | CRITICAL 9.8EPSS 0.67% | 6 October 2026 |
| CVE-2026-94589 | The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. | — | CRITICAL 9.8EPSS 0.66% | 10 October 2026 |
| CVE-2026-62252 | Any attacker who reaches the login endpoint immediately gains full administrative access. | — | CRITICAL 9.8EPSS 0.65% | 7 October 2026 |
| CVE-2026-105324 | An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. | — | CRITICAL 9.2EPSS 0.65% | 7 October 2026 |
| CVE-2026-63692 | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. | dell/container storage modules | CRITICAL 10.0EPSS 0.65% | 6 October 2026 |
| CVE-2026-105285 | A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. | — | CRITICAL 9.3EPSS 0.64% | 5 October 2026 |
| CVE-2026-96408 | A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product. | — | CRITICAL 9.3EPSS 0.64% | 7 October 2026 |
| CVE-2026-106446 | This issue bypasses the AST validation introduced in version 4.7.9 for CVE-2026-33937. | — | CRITICAL 9.8EPSS 0.64% | 6 October 2026 |
| CVE-2026-86360 | Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. | — | CRITICAL 9.6EPSS 0.63% | 6 October 2026 |
| CVE-2026-100730 | A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. | — | CRITICAL 9.3EPSS 0.63% | 9 October 2026 |
| CVE-2026-92414 | : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. | — | CRITICAL 9.3EPSS 0.62% | 7 October 2026 |
New this week with the highest EPSS, any severity
| CVE | Summary | Affects | Priority | Published |
|---|---|---|---|---|
| CVE-2026-105110 | OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter. | — | CRITICAL 9.3EPSS 2.79% | 8 October 2026 |
| CVE-2026-94579 | An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. | — | MEDIUM 5.4EPSS 2.65% | 8 October 2026 |
| CVE-2026-84278 | IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. | ibm/guardium data protection | HIGH 7.2EPSS 2.25% | 8 October 2026 |
| CVE-2026-105484 | A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. | — | CRITICAL 10.0EPSS 2.13% | 6 October 2026 |
| CVE-2026-107780 | Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. | — | CRITICAL 9.3EPSS 2.06% | 8 October 2026 |
| CVE-2026-91140 | An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to… | — | CRITICAL 9.6EPSS 1.92% | 6 October 2026 |
| CVE-2026-106126 | A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe. | — | CRITICAL 9.4EPSS 1.88% | 8 October 2026 |
| CVE-2026-87666 | An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. | — | HIGH 8.6EPSS 1.85% | 8 October 2026 |
| CVE-2026-107703 | @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. | — | CRITICAL 9.3EPSS 1.85% | 8 October 2026 |
| CVE-2026-21589 | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. | — | CRITICAL 9.3EPSS 1.77% | 5 October 2026 |
| CVE-2026-107704 | The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. | — | CRITICAL 9.3EPSS 1.66% | 8 October 2026 |
| CVE-2026-101207 | Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. | — | HIGH 8.8EPSS 1.66% | 6 October 2026 |
| CVE-2026-55797 | From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. | — | HIGH 8.8EPSS 1.55% | 9 October 2026 |
| CVE-2026-107699 | ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. | — | CRITICAL 9.3EPSS 1.47% | 8 October 2026 |
| CVE-2026-107459 | The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. | — | CRITICAL 9.3EPSS 1.47% | 8 October 2026 |
| CVE-2026-102160 | An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service. | — | HIGH 8.6EPSS 1.35% | 6 October 2026 |
| CVE-2026-94581 | An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with… | — | HIGH 8.5EPSS 1.30% | 8 October 2026 |
| CVE-2026-106059 | GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. | — | HIGH 8.7EPSS 1.28% | 7 October 2026 |
| CVE-2026-94586 | A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. | — | HIGH 8.5EPSS 1.25% | 8 October 2026 |
| CVE-2026-106056 | Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. | — | HIGH 7.7EPSS 1.22% | 7 October 2026 |
Newly scored high or critical
Older CVEs that received a CVSS score, or a materially different one, this week. NVD analysis often lags publication by days or weeks, so these are easy to miss.
| CVE | Summary | Affects | Priority | Scored |
|---|---|---|---|---|
| CVE-2026-102255 | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. | — | CRITICAL 10.0EPSS 0.48% | 7 October 2026 |
| CVE-2025-70518 | The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system. | — | CRITICAL 10.0EPSS 0.56% | 7 October 2026 |
| CVE-2026-106218 | In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible | jetbrains/teamcity | CRITICAL 10.0EPSS 0.28% | 8 October 2026 |
| CVE-2015-3306 | ProFTPD Improper Access Control Vulnerability | fedoraproject/fedora · debian/debian linux · opensuse/tumbleweed +2 | KEVEXPLOIT ×4 ✓CRITICAL 10.0EPSS 99.5% | 8 October 2026 |
| CVE-2026-103692 | The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing… | — | CRITICAL 9.8EPSS 0.34% | 8 October 2026 |
| CVE-2026-103646 | The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check… | — | CRITICAL 9.8EPSS 0.44% | 8 October 2026 |
| CVE-2025-71383 | Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field. | — | CRITICAL 9.8EPSS 0.36% | 8 October 2026 |
| CVE-2026-106016 | Mitigation bypass in the File Handling component. | mozilla/firefox | CRITICAL 9.8EPSS 0.28% | 8 October 2026 |
| CVE-2026-103877 | Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. | — | CRITICAL 9.8EPSS 0.57% | 8 October 2026 |
| CVE-2026-93034 | SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability… | — | CRITICAL 9.8EPSS 0.46% | 8 October 2026 |
| CVE-2026-88416 | MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature. | — | CRITICAL 9.8EPSS 0.32% | 6 October 2026 |
| CVE-2026-102827 | simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. | simple-git project/simple-git | CRITICAL 9.8EPSS 0.40% | 8 October 2026 |
| CVE-2026-88393 | WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. | — | CRITICAL 9.8EPSS 0.39% | 6 October 2026 |
| CVE-2025-70521 | The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system. | — | CRITICAL 9.8EPSS 0.43% | 7 October 2026 |
| CVE-2026-88424 | FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). | — | CRITICAL 9.8EPSS 0.28% | 6 October 2026 |
| CVE-2026-104711 | Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. | apache/struts | CRITICAL 9.8EPSS 1.19% | 6 October 2026 |
| CVE-2026-37719 | An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component. | — | CRITICAL 9.8EPSS 0.74% | 6 October 2026 |
| CVE-2026-94205 | Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. | — | CRITICAL 9.8EPSS 0.34% | 7 October 2026 |
| CVE-2026-76459 | This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. | — | CRITICAL 9.8EPSS 0.31% | 9 October 2026 |
| CVE-2026-82335 | IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. | ibm/guardium data protection | CRITICAL 9.8EPSS 0.38% | 9 October 2026 |
| CVE-2026-81478 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. | dell/openmanage server administrator | CRITICAL 9.8EPSS 0.29% | 6 October 2026 |
| CVE-2026-93675 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion. | langflow/langflow | CRITICAL 9.8EPSS 0.75% | 8 October 2026 |
| CVE-2026-82989 | There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints | — | CRITICAL 9.8EPSS 0.67% | 6 October 2026 |
| CVE-2026-82344 | IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. | ibm/guardium data protection | CRITICAL 9.8EPSS 0.40% | 9 October 2026 |
| CVE-2026-73278 | Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. | — | CRITICAL 9.8EPSS 0.47% | 7 October 2026 |
| CVE-2026-56857 | On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. | — | CRITICAL 9.8EPSS 0.49% | 9 October 2026 |
| CVE-2026-88391 | Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. | — | CRITICAL 9.8EPSS 0.36% | 6 October 2026 |
| CVE-2026-98323 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. | — | CRITICAL 9.8EPSS 0.56% | 7 October 2026 |
| CVE-2026-51922 | agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py). | — | CRITICAL 9.8EPSS 0.94% | 6 October 2026 |
| CVE-2026-51915 | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. | — | CRITICAL 9.8EPSS 0.58% | 6 October 2026 |
| CVE-2026-51898 | sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute. | — | CRITICAL 9.8EPSS 0.33% | 6 October 2026 |
| CVE-2026-51886 | langflow-ai langflow v1.9.3 is affected by: Code Injection. | — | CRITICAL 9.8EPSS 0.40% | 6 October 2026 |
| CVE-2026-51881 | deeptutor 1.4.0 contains code injection in ExecTool.execute. | — | CRITICAL 9.8EPSS 0.33% | 6 October 2026 |
| CVE-2026-104056 | Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. | — | CRITICAL 9.8EPSS 0.17% | 5 October 2026 |
| CVE-2026-51904 | SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. | — | CRITICAL 9.8EPSS 0.41% | 5 October 2026 |
| CVE-2026-51897 | RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). | — | CRITICAL 9.8EPSS 0.73% | 5 October 2026 |
| CVE-2026-76284 | Improper Neutralization. | — | CRITICAL 9.8EPSS 0.33% | 10 October 2026 |
| CVE-2026-98365 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone… | — | CRITICAL 9.8EPSS 0.38% | 7 October 2026 |
| CVE-2026-51880 | deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. | — | CRITICAL 9.8EPSS 0.40% | 5 October 2026 |
| CVE-2026-51893 | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. | — | CRITICAL 9.8EPSS 0.27% | 5 October 2026 |
How to read this page
Volume is not the story; the story is the handful that matter. Start with the KEV additions, which are confirmed exploitation, then the new public exploits and the EPSS jumps, which are exploitation becoming easy and likely, then the new criticals in EPSS order. Everything else goes in the normal cycle. The watchlist applies exactly this ordering to just your products and will email it to you; the KEV calendar shows the deadlines further out.
Data from NVD, FIRST EPSS, CISA KEV and Exploit-DB, refreshed daily. The window is a rolling seven days ending now, so the page is different every day and the feed carries each item once.