Tools / This week28 October 2026 – 4 November 2026
This week in CVEs
In the last seven days 3,119 CVEs were published, 255 of them critical. 5 were added to CISA’s known-exploited list, and 35 saw their EPSS exploitation probability jump. 4 KEV deadlines fall in the coming week.
Critical
255
High
1,110
Medium
1,096
Low
139
None
2
Not yet scored
517
RSS feed ↗Only for my products →Refreshed daily · rolling seven days
Added to CISA KEV this week
Vulnerabilities CISA confirmed are being exploited in the wild. If any of these is in your estate it is an emergency change, and the due date is the latest anyone should tolerate.
| CVE | Summary | Affects | Priority | Added |
|---|---|---|---|---|
| CVE-2026-119977 | WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability | — | KEVHIGH 8.1EPSS 0.60% | 3 November 2026 |
| CVE-2026-111357 | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | ivanti/connect secure | KEVHIGH 7.0EPSS 0.53% | 30 October 2026 |
| CVE-2026-118527 | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | ivanti/connect secure | KEVMEDIUM 4.3EPSS — | 30 October 2026 |
| CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | cisco/adaptive security appliance software · cisco/secure firewall threat defense | KEVHIGH 8.6EPSS 0.82% | 29 October 2026 |
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | gitlab/gitlab · ruby-lang/ruby | KEVCRITICAL 10.0EPSS 27.7% | 29 October 2026 |
KEV deadlines in the coming week
Full calendar →| CVE | Summary | Affects | Priority | Due |
|---|---|---|---|---|
| CVE-2026-119977 | WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability | — | KEVHIGH 8.1EPSS 0.60% | 6 November 2026 |
| CVE-2026-111497 | Google Brotli Unchecked Return Value Vulnerability | google/brotli · nodejs/node.js · python-hyper/brotlicffi +22 | KEVCRITICAL 9.2EPSS 82.6% | 10 November 2026 |
| CVE-2026-48356 | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | adobe/commerce · adobe/commerce b2b · adobe/magento +1 | KEVCRITICAL 9.3EPSS 44.6% | 10 November 2026 |
| CVE-2026-41709 | Broadcom VMWare ESX Insufficient Logging Vulnerability | vmware/esxi | KEVLOW 2.7EPSS 0.69% | 11 November 2026 |
New public exploits
CVEs that gained their first public exploit in Exploit-DB this week. A published exploit removes the skill barrier; these tend to appear in scanning traffic within days.
No CVE gained its first public exploit this week.
EPSS jumps
CVEs whose EPSS score rose by five points or more, or crossed the ten per cent line, in the last seven days. A jump usually means a public exploit or a scanning campaign appeared.
| CVE | Summary | EPSS | Priority | When |
|---|---|---|---|---|
| CVE-2026-110447 | Collabora Online – Built-in CODE Server OS Command Injection Vulnerabilitycollabora/collabora online - built-in code server | 11.6% → 73.3% | KEVCRITICAL 9.2EPSS 73.3% | 29 October 2026 |
| CVE-2025-58434 | This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO).flowiseai/flowise | 50.5% → 76.4% | EXPLOITCRITICAL 9.8EPSS 82.6% | 29 October 2026 |
| CVE-2026-102489 | Zammad GmbH Zammad Session Fixation Vulnerabilityzammad/zammad | 2.0% → 22.5% | KEVCRITICAL 9.4EPSS 22.5% | 29 October 2026 |
| CVE-2023-31719 | FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.frangoteam/fuxa | 26.0% → 44.1% | CRITICAL 9.8EPSS 44.1% | 30 October 2026 |
| CVE-2021-3128 | In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its…asus/zenwifi ax \(xt8\) firmware · asus/rt-ax3000 firmware · asus/rt-ax55 firmware | 2.2% → 16.2% | HIGH 7.5EPSS 16.2% | 1 November 2026 |
| CVE-2025-47269 | Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. | 44.5% → 56.3% | HIGH 8.3EPSS 56.3% | 1 November 2026 |
| CVE-2026-102490 | Zammad GmbH Zammad Improper Privilege Management Vulnerabilityzammad/zammad | 0.9% → 10.9% | KEVCRITICAL 9.4EPSS 10.9% | 29 October 2026 |
| CVE-2026-96652 | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerabilityplex/media server | 1.8% → 11.9% | KEVMEDIUM 5.3EPSS 11.9% | 3 November 2026 |
| CVE-2019-6446 | It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call.numpy/numpy · fedoraproject/fedora | 17.5% → 27.3% | CRITICAL 9.8EPSS 27.3% | 2 November 2026 |
| CVE-2012-6435 | When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the CPU to stop logic execution and enter a fault state, a DoS can occur.rockwellautomation/controllogix controllers · rockwellautomation/guardlogix controllers · rockwellautomation/micrologix | 33.5% → 42.8% | HIGH 7.5EPSS 42.8% | 30 October 2026 |
| CVE-2025-31125 | Vite Vitejs Improper Access Control Vulnerabilityvitejs/vite | 65.8% → 74.9% | KEVHIGH 7.5EPSS 74.9% | 29 October 2026 |
| CVE-2016-5645 | Rockwell Automation MicroLogix 1400 PLC 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA, and 1766-L32BXBA devices have a hardcoded SNMP community, which makes it easier for remote attackers to load arbitrary firmware updates by…rockwellautomation/1766-l32awa · rockwellautomation/1766-l32awaa · rockwellautomation/1766-l32bwa | 29.6% → 38.5% | HIGH 7.3EPSS 38.5% | 30 October 2026 |
| CVE-2026-68820 | Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerabilitymicrosoft/windows 10 1607 · microsoft/windows 10 1809 · microsoft/windows 10 21h2 | 0.3% → 8.6% | KEVHIGH 7.0EPSS 8.57% | 30 October 2026 |
| CVE-2012-6438 | An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the NIC to crash.rockwellautomation/controllogix controllers · rockwellautomation/guardlogix controllers · rockwellautomation/micrologix | 27.4% → 35.5% | HIGH 7.5EPSS 35.5% | 30 October 2026 |
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerabilitygitlab/gitlab · ruby-lang/ruby | 18.4% → 26.6% | KEVCRITICAL 10.0EPSS 27.7% | 30 October 2026 |
| CVE-2012-6436 | An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the CPU to crash.rockwellautomation/controllogix controllers · rockwellautomation/guardlogix controllers · rockwellautomation/micrologix | 27.1% → 35.2% | HIGH 7.5EPSS 35.2% | 30 October 2026 |
| CVE-2023-54335 | eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request.extplorer/extplorer | 5.7% → 13.7% | CRITICAL 9.3EPSS 13.7% | 30 October 2026 |
| CVE-2008-4824 | Multiple unspecified vulnerabilities in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0 allow remote attackers to execute arbitrary code via unknown vectors related to "input validation errors."adobe/flash player | 13.3% → 21.1% | HIGH 9.3EPSS 21.1% | 2 November 2026 |
| CVE-2025-58434 | This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO).flowiseai/flowise | 76.4% → 82.6% | EXPLOITCRITICAL 9.8EPSS 82.6% | 2 November 2026 |
| CVE-2024-52012 | Relative Path Traversal vulnerability in Apache Solr.apache/solr | 41.2% → 47.1% | MEDIUM 5.4EPSS 47.1% | 3 November 2026 |
| CVE-2026-46300 | Linux Kernel Missing Initialization of a Variable Vulnerabilitylinux/linux kernel · siemens/simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware · redhat/openshift container platform | 10.2% → 15.7% | KEVEXPLOITHIGH 7.8EPSS 16.1% | 29 October 2026 |
| CVE-2026-42533 | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable.f5/nginx gateway fabric · f5/nginx ingress controller · f5/nginx plus | 0.9% → 6.3% | CRITICAL 9.2EPSS 6.30% | 1 November 2026 |
| CVE-2020-5260 | Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker.git/git · git-scm/git · canonical/ubuntu linux | 10.0% → 14.9% | HIGH 7.5EPSS 14.9% | 2 November 2026 |
| CVE-2012-6437 | The device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet card, whether it is a corrupt or legitimate firmware image.rockwellautomation/controllogix controllers · rockwellautomation/guardlogix controllers · rockwellautomation/micrologix | 7.8% → 10.5% | CRITICAL 9.8EPSS 10.5% | 30 October 2026 |
| CVE-2025-54766 | The endpoint can be used to export the appliance configuration, exposing sensitive information.xorux/xormon | 8.5% → 10.2% | MEDIUM 5.3EPSS 10.2% | 29 October 2026 |
| CVE-2025-54765 | The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.xorux/xormon | 8.5% → 10.2% | MEDIUM 5.3EPSS 10.2% | 29 October 2026 |
| CVE-2016-10972 | The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.tagdiv/newspaper | 9.3% → 10.8% | CRITICAL 9.8EPSS 10.8% | 3 November 2026 |
| CVE-2024-54188 | Infoblox NETMRI before 7.6.1 has a vulnerability allowing remote authenticated users to read arbitrary files with root access.infoblox/netmri | 9.3% → 10.5% | MEDIUM 5.3EPSS 10.5% | 29 October 2026 |
| CVE-2025-58176 | In versions 0.9.0 through 0.9.3, there is a one-click Remote Code Execution vulnerability triggered through a custom url value, `transport` in the JSON object.openagentplatform/dive | 9.3% → 10.0% | HIGH 8.8EPSS 10.0% | 3 November 2026 |
| CVE-2024-52739 | D-LINK DI-8400 v16.07.26A1 was discovered to contain multiple remote command execution (RCE) vulnerabilities in the msp_info_htm function via the flag and cmd parameters.dlink/di-8400 firmware | 9.7% → 10.3% | HIGH 8.0EPSS 10.3% | 29 October 2026 |
| CVE-2025-10628 | A vulnerability was found in D-Link DIR-852 1.00CN B09.dlink/dir-852 firmware | 9.7% → 10.1% | LOW 2.1EPSS 10.1% | 29 October 2026 |
| CVE-2006-6299 | Integer overflow in Msg.dll in Novell ZENworks 7 Asset Management (ZAM) before SP1 IR11 and the Collection client allows remote attackers to execute arbitrary code via crafted packets, which trigger a heap-based buffer overflow.novell/zenworks asset management | 9.7% → 10.0% | HIGH 10.0EPSS 10.0% | 2 November 2026 |
| CVE-2006-2323 | Multiple PHP remote file inclusion vulnerabilities in SmartISoft phpListPro 2.01 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the returnpath parameter in (1) editsite.php, (2) addsite.php, and (3) in.php.smartisoft/phplistpro | 9.8% → 10.1% | EXPLOIT ✓MEDIUM 5.1EPSS 10.1% | 29 October 2026 |
| CVE-2021-42580 | Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/admin/login.php) and authenticated file upload in (Master.php) file , we can craft these two vunlerablities to get unauthenticated…oretnom23/online learning system | 10.0% → 10.1% | EXPLOITCRITICAL 9.8EPSS 10.1% | 1 November 2026 |
| CVE-2008-0900 | Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.bea/weblogic server · bea systems/weblogic express | 10.0% → 10.1% | MEDIUM 6.0EPSS 10.1% | 1 November 2026 |
New critical CVEs, most likely exploited first
The 255 critical-severity CVEs published this week, ordered by EPSS. The top of this list is where a patch cycle should start when nothing above applies.
| CVE | Summary | Affects | Priority | Published |
|---|---|---|---|---|
| CVE-2026-120276 | A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. | — | CRITICAL 9.3EPSS 3.21% | 2 November 2026 |
| CVE-2026-120277 | A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. | — | CRITICAL 9.3EPSS 2.45% | 2 November 2026 |
| CVE-2026-93680 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. | langflow/langflow | CRITICAL 9.8EPSS 2.18% | 29 October 2026 |
| CVE-2026-120195 | A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. | — | CRITICAL 9.3EPSS 2.07% | 1 November 2026 |
| CVE-2026-120198 | A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. | — | CRITICAL 9.3EPSS 2.07% | 1 November 2026 |
| CVE-2026-120279 | Executing a manipulation of the argument file_id can lead to os command injection. | — | CRITICAL 9.3EPSS 1.99% | 2 November 2026 |
| CVE-2026-120280 | A vulnerability has been found in WAVLINK WN536AX6-A V260507. | — | CRITICAL 9.3EPSS 1.99% | 2 November 2026 |
| CVE-2026-120344 | A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. | — | CRITICAL 9.3EPSS 1.99% | 2 November 2026 |
| CVE-2026-120345 | A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. | — | CRITICAL 9.3EPSS 1.99% | 2 November 2026 |
| CVE-2026-90868 | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations. | — | CRITICAL 9.9EPSS 1.49% | 29 October 2026 |
| CVE-2026-86596 | The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. | — | CRITICAL 9.8EPSS 1.49% | 2 November 2026 |
| CVE-2026-97854 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. | — | CRITICAL 9.3EPSS 1.37% | 29 October 2026 |
| CVE-2025-31704 | A vulnerability has been found in the Dahua Intelligent Connection Center. | — | CRITICAL 9.8EPSS 1.36% | 30 October 2026 |
| CVE-2026-120189 | A vulnerability was identified in D-Link DIR-505 1.10B02. | — | CRITICAL 9.3EPSS 1.35% | 1 November 2026 |
| CVE-2026-90865 | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations. | — | CRITICAL 9.0EPSS 1.14% | 29 October 2026 |
| CVE-2026-13594 | Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product. | — | CRITICAL 9.1EPSS 1.14% | 3 November 2026 |
| CVE-2026-119706 | InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. | — | CRITICAL 9.3EPSS 1.03% | 30 October 2026 |
| CVE-2026-116366 | An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server. | — | CRITICAL 9.5EPSS 0.96% | 30 October 2026 |
| CVE-2026-114278 | When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks). | — | CRITICAL 9.8EPSS 0.90% | 28 October 2026 |
| CVE-2026-51863 | DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). | — | CRITICAL 9.1EPSS 0.81% | 29 October 2026 |
| CVE-2026-103882 | The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to,… | — | CRITICAL 9.1EPSS 0.79% | 31 October 2026 |
| CVE-2026-120518 | The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. | — | CRITICAL 9.1EPSS 0.78% | 3 November 2026 |
| CVE-2026-120338 | From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. | — | CRITICAL 10.0EPSS 0.77% | 1 November 2026 |
| CVE-2026-119145 | Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. | — | CRITICAL 9.4EPSS 0.76% | 29 October 2026 |
| CVE-2026-61991 | Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. | — | CRITICAL 10.0EPSS 0.75% | 29 October 2026 |
| CVE-2026-104339 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | langflow/langflow | CRITICAL 9.8EPSS 0.75% | 29 October 2026 |
| CVE-2026-115904 | A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. | — | CRITICAL 9.6EPSS 0.74% | 28 October 2026 |
| CVE-2026-118235 | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. | — | CRITICAL 9.8EPSS 0.74% | 31 October 2026 |
| CVE-2026-90866 | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution. | — | CRITICAL 9.1EPSS 0.73% | 29 October 2026 |
| CVE-2026-116606 | An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized… | — | CRITICAL 9.3EPSS 0.73% | 2 November 2026 |
| CVE-2026-110799 | Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. | — | CRITICAL 9.8EPSS 0.71% | 30 October 2026 |
| CVE-2026-44179 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. | — | CRITICAL 9.9EPSS 0.69% | 28 October 2026 |
| CVE-2026-120213 | A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to… | — | CRITICAL 9.1EPSS 0.69% | 2 November 2026 |
| CVE-2026-118690 | Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. | — | CRITICAL 9.3EPSS 0.69% | 28 October 2026 |
| CVE-2026-66088 | In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. | — | CRITICAL 9.4EPSS 0.69% | 29 October 2026 |
| CVE-2026-90863 | Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary… | — | CRITICAL 9.1EPSS 0.66% | 29 October 2026 |
| CVE-2026-64618 | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). | apache/fineract | CRITICAL 9.8EPSS 0.62% | 30 October 2026 |
| CVE-2026-110186 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | langflow/langflow | CRITICAL 9.8EPSS 0.62% | 29 October 2026 |
| CVE-2026-120201 | Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. | — | CRITICAL 9.3EPSS 0.60% | 31 October 2026 |
| CVE-2026-118633 | A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with… | — | CRITICAL 9.2EPSS 0.60% | 28 October 2026 |
New this week with the highest EPSS, any severity
| CVE | Summary | Affects | Priority | Published |
|---|---|---|---|---|
| CVE-2026-120276 | A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. | — | CRITICAL 9.3EPSS 3.21% | 2 November 2026 |
| CVE-2026-101214 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. | — | HIGH 7.2EPSS 2.83% | 30 October 2026 |
| CVE-2026-101210 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. | — | HIGH 7.2EPSS 2.83% | 30 October 2026 |
| CVE-2026-120229 | A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. | — | HIGH 8.5EPSS 2.82% | 1 November 2026 |
| CVE-2026-91913 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. | — | HIGH 8.8EPSS 2.65% | 30 October 2026 |
| CVE-2026-119409 | OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. | — | HIGH 8.6EPSS 2.48% | 30 October 2026 |
| CVE-2026-18199 | Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability. | — | HIGH 8.8EPSS 2.45% | 2 November 2026 |
| CVE-2026-120277 | A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. | — | CRITICAL 9.3EPSS 2.45% | 2 November 2026 |
| CVE-2026-77691 | ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA | — | HIGH 8.1EPSS 2.25% | 3 November 2026 |
| CVE-2026-120230 | A vulnerability was found in WAVLINK WN701AE 260105. | — | HIGH 8.6EPSS 2.21% | 1 November 2026 |
| CVE-2026-120227 | A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. | — | HIGH 8.6EPSS 2.21% | 1 November 2026 |
| CVE-2026-93680 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. | langflow/langflow | CRITICAL 9.8EPSS 2.18% | 29 October 2026 |
| CVE-2026-8923 | Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option. | — | HIGH 8.7EPSS 2.18% | 2 November 2026 |
| CVE-2026-94349 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. | dell/openmanage enterprise | HIGH 8.0EPSS 2.16% | 2 November 2026 |
| CVE-2026-77876 | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST… | — | HIGH 8.7EPSS 2.16% | 2 November 2026 |
| CVE-2026-120198 | A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. | — | CRITICAL 9.3EPSS 2.07% | 1 November 2026 |
| CVE-2026-120195 | A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. | — | CRITICAL 9.3EPSS 2.07% | 1 November 2026 |
| CVE-2026-120345 | A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. | — | CRITICAL 9.3EPSS 1.99% | 2 November 2026 |
| CVE-2026-120344 | A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. | — | CRITICAL 9.3EPSS 1.99% | 2 November 2026 |
| CVE-2026-120280 | A vulnerability has been found in WAVLINK WN536AX6-A V260507. | — | CRITICAL 9.3EPSS 1.99% | 2 November 2026 |
Newly scored high or critical
Older CVEs that received a CVSS score, or a materially different one, this week. NVD analysis often lags publication by days or weeks, so these are easy to miss.
| CVE | Summary | Affects | Priority | Scored |
|---|---|---|---|---|
| CVE-2026-113897 | This issue was addressed by removing the vulnerable code. | apple/safari · apple/ipados · apple/iphone os +2 | CRITICAL 10.0EPSS 0.35% | 3 November 2026 |
| CVE-2026-112690 | A remote attacker may be able to break out of the WebContent sandbox. | apple/ipados · apple/iphone os · apple/macos +1 | CRITICAL 10.0EPSS 0.35% | 3 November 2026 |
| CVE-2026-113617 | The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including… | — | CRITICAL 9.9EPSS 0.34% | 29 October 2026 |
| CVE-2026-64618 | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). | apache/fineract | CRITICAL 9.8EPSS 0.62% | 2 November 2026 |
| CVE-2026-104317 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data. | langflow/langflow | CRITICAL 9.8EPSS 0.59% | 30 October 2026 |
| CVE-2026-18894 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. | langflow/langflow | CRITICAL 9.8EPSS 0.52% | 30 October 2026 |
| CVE-2026-107058 | An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state. | — | CRITICAL 9.8EPSS 0.49% | 29 October 2026 |
| CVE-2026-31158 | SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Login Page | — | CRITICAL 9.8EPSS 0.69% | 29 October 2026 |
| CVE-2026-76527 | This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. | — | CRITICAL 9.8EPSS 0.43% | 29 October 2026 |
| CVE-2026-113399 | This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | — | CRITICAL 9.8EPSS 0.49% | 29 October 2026 |
| CVE-2026-108771 | Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. | — | CRITICAL 9.8EPSS 0.47% | 30 October 2026 |
| CVE-2026-58663 | An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. | — | CRITICAL 9.8EPSS 0.56% | 30 October 2026 |
| CVE-2026-59562 | Missing authentication for critical function vulnerability in Apache IoTDB. | — | CRITICAL 9.8EPSS 0.57% | 30 October 2026 |
| CVE-2025-13204 | npm package `expr-eval` is vulnerable to Prototype Pollution. | silentmatt/javascript expression evaluator | CRITICAL 9.8EPSS 0.85% | 30 October 2026 |
| CVE-2026-83523 | Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network. | microsoft/windows 11 24h2 · microsoft/windows 11 25h2 · microsoft/windows 11 26h1 +2 | CRITICAL 9.8EPSS 0.93% | 29 October 2026 |
| CVE-2026-76408 | This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. | — | CRITICAL 9.8EPSS 0.39% | 30 October 2026 |
| CVE-2026-76529 | This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. | — | CRITICAL 9.8EPSS 0.39% | 30 October 2026 |
| CVE-2026-107249 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. | — | CRITICAL 9.8EPSS 0.39% | 30 October 2026 |
| CVE-2026-78845 | Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root description parsing. | — | CRITICAL 9.8EPSS 0.78% | 31 October 2026 |
| CVE-2026-99153 | In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the… | — | CRITICAL 9.8EPSS 0.55% | 31 October 2026 |
| CVE-2026-99154 | In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse_pdu_itt A transport that implements parse_pdu_itt hands libiscsi an index taken from the PDU, and both lookups bound it from… | — | CRITICAL 9.8EPSS 0.51% | 31 October 2026 |
| CVE-2026-115245 | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to… | — | CRITICAL 9.8EPSS 0.46% | 29 October 2026 |
| CVE-2026-113616 | The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any… | — | CRITICAL 9.8EPSS 0.34% | 29 October 2026 |
| CVE-2026-83789 | Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network. | microsoft/windows 10 1607 · microsoft/windows 10 1809 · microsoft/windows 10 21h2 +11 | CRITICAL 9.8EPSS 0.85% | 28 October 2026 |
| CVE-2026-103688 | The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload… | — | CRITICAL 9.8EPSS 0.61% | 28 October 2026 |
| CVE-2026-70275 | Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network. | microsoft/windows 10 1607 · microsoft/windows 10 1809 · microsoft/windows 10 21h2 +11 | CRITICAL 9.8EPSS 0.93% | 28 October 2026 |
| CVE-2026-70262 | Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network. | microsoft/windows 10 1607 · microsoft/windows 10 1809 · microsoft/windows 10 21h2 +11 | CRITICAL 9.8EPSS 0.93% | 28 October 2026 |
| CVE-2026-115915 | Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. | vllm/vllm | CRITICAL 9.8EPSS 0.66% | 28 October 2026 |
| CVE-2026-107057 | An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip. | — | CRITICAL 9.8EPSS 0.39% | 2 November 2026 |
| CVE-2026-76407 | This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. | — | CRITICAL 9.8EPSS 0.43% | 2 November 2026 |
| CVE-2026-76528 | This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. | — | CRITICAL 9.8EPSS 0.36% | 2 November 2026 |
| CVE-2026-79589 | The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. | — | CRITICAL 9.8EPSS 0.34% | 3 November 2026 |
| CVE-2026-38600 | A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive. | — | CRITICAL 9.8EPSS — | 3 November 2026 |
| CVE-2026-107048 | An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request. | — | CRITICAL 9.8EPSS 0.18% | 3 November 2026 |
| CVE-2026-112526 | A buffer overflow was addressed with improved bounds checking. | — | CRITICAL 9.8EPSS 0.38% | 3 November 2026 |
| CVE-2026-112552 | An out-of-bounds write issue was addressed with improved bounds checking. | — | CRITICAL 9.8EPSS 0.22% | 3 November 2026 |
| CVE-2026-51912 | OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (ToolServer/ToolServerNode/main.py:46). | — | CRITICAL 9.8EPSS 0.24% | 4 November 2026 |
| CVE-2025-49602 | An issue was discovered in Keyfactor EJBCA 9. | — | CRITICAL 9.8EPSS 0.19% | 4 November 2026 |
| CVE-2026-79624 | Insufficient session expiration vulnerability in Apache Answer. | — | CRITICAL 9.8EPSS 0.18% | 3 November 2026 |
| CVE-2026-107050 | An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution. | — | CRITICAL 9.8EPSS 0.17% | 4 November 2026 |
How to read this page
Volume is not the story; the story is the handful that matter. Start with the KEV additions, which are confirmed exploitation, then the new public exploits and the EPSS jumps, which are exploitation becoming easy and likely, then the new criticals in EPSS order. Everything else goes in the normal cycle. The watchlist applies exactly this ordering to just your products and will email it to you; the KEV calendar shows the deadlines further out.
Data from NVD, FIRST EPSS, CISA KEV and Exploit-DB, refreshed daily. The window is a rolling seven days ending now, so the page is different every day and the feed carries each item once.