10 to act on now: PHP flaws, Plex Media Server, network appliances
October 26, 2026 · covering 2026-10-19 to 2026-10-26 (through 20:00 ET)
10require immediate attention
63should be reviewed
1009high-CVSS, low real-world priority
4053assessed this week
8new CISA KEV additions
PHP faces two critical pre-auth remote code execution flaws this week, both already in CISA’s KEV and exploitable at scale; Plex Media Server accounts for four additional KEV entries, all unauthenticated and reachable over the internet. The remaining four act-now items span network appliances and cloud services. A large cohort of high-CVSS items carry no exploitation signal and belong in routine patch cycles.
319 records lack EPSS scores or exploitation enrichment; they were scored while data sources were degraded. This does not affect the act-now tier, which is complete.
New KEV additions this week
Added to CISA’s Known Exploited Vulnerabilities catalog during this window, whatever the
published date. Entries an earlier brief already shipped reappear here because the KEV listing itself is new.
| CVE | Tier | Vendor | Product | KEV added | KEV due | Ransomware | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-114625 | ACT_NOW | arista, arista networks | velocloud_orchestrator, velocloud orchestrator | 2026-10-23 | 2026-10-26 | 2026-10-22 | |
| CVE-2026-110447 | ACT_NOW | collabora | collabora online – built-in code server | 2026-10-23 | 2026-10-26 | 2026-10-14 | |
| CVE-2026-110936 | ACT_NOW | siemens | siemens software center | 2026-10-20 | 2026-11-03 | 2026-10-15 | |
| CVE-2026-106931 | ACT_NOW | eg secure solutions inc. | siteguard server edition for apache httpd, siteguard server edition for nginx | 2026-10-20 | 2026-10-23 | 2026-10-14 | |
| CVE-2026-96656 | ACT_NOW | plex | media_server, media server | 2026-10-20 | 2026-10-23 | 2026-09-23 | |
| CVE-2026-96654 | ACT_NOW | plex | media_server, media server | 2026-10-20 | 2026-10-23 | 2026-09-23 | |
| CVE-2026-96652 | ACT_NOW | plex | media_server, media server | 2026-10-20 | 2026-11-03 | 2026-09-23 | |
| CVE-2026-96655 | ACT_NOW | plex | media_server, media server | 2026-10-20 | 2026-11-03 | 2026-09-23 |
Complete data — all vulnerabilities new or updated this week
Sorted by Quatronics priority score. Threat, Reach and Effort are the three axes behind it.
Effort is inverted: 100 means the fix is trivial.
| CVE | Tier | Priority | Threat | Reach | Effort | CVSS | EPSS %ile | KEV | SSVC | Exploit artifacts | Evidence class | Vendor | Affected versions | Published | Assessment | Recommended action |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CVE-2026-109619 | ACT_NOW | 95 | 100 | 100 | 80 | 8.1 | 100.0 | Yes | none | cisa_only | php, siemens | php · ruggedcom_ape1808_firmware · pan-os 10.2.7, 10.2.8, 10.2.9, 10.2.10 +7 more | 2026-10-21 | Unauthenticated remote code execution in PHP itself, reachable over the internet, with a near-certain EPSS score and CISA KEV listing; PHP underpins countless web apps and appliances, so exposure is effectively everywhere. | Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart all workers. If you cannot update immediately, set session.upload_progress.enabled=0 (plus fatal_error_backtraces=0 on 8.5) and restart workers, then patch. | |
| CVE-2026-109618 | ACT_NOW | 95 | 100 | 100 | 80 | 9.8 | 100.0 | Yes | none | EDB✓ nuclei | confirmed_exploited | php, siemens | php · ruggedcom_ape1808_firmware · pan-os 10.2.7, 10.2.8, 10.2.9, 10.2.10 +7 more | 2026-10-21 | PHP is ubiquitous and this is pre-auth remote code execution reachable over the network, with a verified ExploitDB entry, a fresh detection template, EPSS near 1.0 and CISA KEV listing. | Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart all PHP workers. If you cannot update immediately, set memory_limit=-1 as an incomplete stopgap only, and inventory internet-facing PHP (including PAN-OS and Siemens Ruggedcom components) for exposure. |
| CVE-2026-114625 | ACT_NOW | 72 | 99 | 25 | 65 | 9.9 | 63.3 | Yes | active | cisa_only | arista, arista networks | velocloud_orchestrator · velocloud orchestrator | 2026-10-22 | CISA requires forensic triage (BOD 26-04); CISA reports exploitation with no public exploit code found (targeted or commercial tooling) | Apply the vendor fix: Upgrade to VCO 5.2.3.18 or later in the 5.2 train, 6.1.3.10 or later in the 6.1 train, or 6.4.2.12 or later in the 6.4 train. CISA links the advisory: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199. Until it is applied, identify where velocloud_orchestrator is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. | |
| CVE-2026-110447 | ACT_NOW | 69 | 89 | 33 | 65 | 9.2 | 96.2 | Yes | active | cisa_only | collabora | collabora online – built-in code server | 2026-10-14 | OS command injection in the Nextcloud richdocumentscode app, reachable without authentication over the internet, and the description states it was exploited in the wild in September and October 2026. | Update the richdocumentscode Nextcloud app to 26.4.303 or later and restart the service. Until patched, restrict access to the app path and treat the host as potentially compromised given confirmed in-the-wild exploitation. | |
| CVE-2026-110936 | ACT_NOW | 59 | 73 | 50 | 40 | 6.7 | 2.7 | Yes | active | cisa_only | siemens | siemens software center | 2026-10-15 | It is in CISA KEV with a vendor fix confirmed at Software Center V4.0.9.8, but the trigger is an authenticated local attacker with high privileges placing a DLL, and EPSS is 0.00135 (2.7th percentile). | Apply the vendor fix: Update Siemens Software Center to V4.0.9.8 or later, per Siemens advisory SSA-580366. CISA links the advisory: https://productcert.siemens.com/productcert/html/ssa-580366.html. Until it is applied, identify where siemens software center is deployed and exposed, then tighten local access and review who holds accounts on those hosts. | |
| CVE-2026-113022 | REVIEW | 57 | 29 | 90 | 80 | 8.8 | 36.4 | poc | poc_early | chrome | 2026-10-20 | Memory corruption in Chrome’s PDFium reachable from a crafted HTML page with no authentication, but exploitation is only at proof-of-concept stage and EPSS sits at 0.4%. | Update Google Chrome to 156.0.8078.47 or later on all managed endpoints; verify version via your browser management console and force a restart to complete the update. | |||
| CVE-2026-106931 | ACT_NOW | 55 | 63 | 13 | 80 | 8.5 | 50.8 | Yes | active | cisa_only | eg secure solutions inc. | siteguard server edition for iis · siteguard server edition for apache httpd on freebsd · siteguard server edition for nginx on freebsd | 2026-10-14 | OS command injection in SiteGuard Server Edition yielding root/SYSTEM command execution, and CISA has added it to KEV with a BOD 26-04 forensic-triage requirement. EPSS is low (0.00662) and no public exploit code is recorded, so urgency rests on the KEV listing and impact. | Update SiteGuard Server Edition to Ver8.00 Update 5 or later; all versions from Ver2.20 up to but not including Ver8.00 Update 5 are affected. Plan a service restart for the update, and until patched restrict management access to trusted networks. | |
| CVE-2026-96656 | ACT_NOW | 54 | 65 | 21 | 65 | 7.2 | 32.3 | Yes | cisa_only | plex | media_server · media server | 2026-09-23 | CISA KEV-listed with a vendor fix already named, and the flaw turns a Plex admin account into code execution at service restart — but exploitation presupposes admin credentials on the instance, so it is a consolidation risk, not a drive-by. | Apply the vendor fix: Upgrade Plex Media Server to 1.43.3.10861 or later; versions before 1.43.3.10861 are affected. CISA links the advisory: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319. Until it is applied, identify where media_server is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. | ||
| CVE-2026-111497 | REVIEW | 54 | 37 | 78 | 65 | 9.2 | 98.3 | none | none | brotli | 2026-10-22 | Pre-auth, no-user-interaction buffer overflow in a widely embedded decompression library; EPSS sits at the 98th percentile, though no public exploit code, KEV listing or confirmed exploitation exists yet. | Inventory where Brotli 1.0.3-1.2.0 is bundled (web servers, proxies, language runtimes, packaged apps) and upgrade to 1.0.10, 1.1.1 or 1.2.1, restarting affected services. Prioritise any path that decompresses untrusted input from the internet. | |||
| CVE-2026-112995 | REVIEW | 53 | 29 | 90 | 65 | 8.8 | 34.6 | poc | poc_early | chrome | 2026-10-20 | Use-after-free in Chrome’s Animation component reachable from any crafted HTML page with no authentication, and the fix is already published; EPSS is low (0.004) and no exploit code or active exploitation is confirmed. | Update Google Chrome to 156.0.8078.47 or later on all endpoints; the update requires a browser restart, so schedule it and verify version compliance across managed fleets. | |||
| CVE-2026-113147 | REVIEW | 53 | 29 | 90 | 65 | 8.8 | 40.9 | poc | poc_early | chrome | 2026-10-20 | Chrome is ubiquitous and this is a sandbox-escape-class flaw reachable from a crafted HTML page with no authentication, but exploitation is only at proof-of-concept stage and EPSS is low (0.0049). | Update Google Chrome to 156.0.8078.47 or later on all managed endpoints; verify version via your browser management console and force a restart to complete the update. | |||
| CVE-2026-113009 | REVIEW | 53 | 29 | 90 | 65 | 8.8 | 31.3 | poc | poc_early | chrome | 2026-10-20 | Use-after-free in Chrome’s WindowControlsOverlay reachable from a crafted HTML page with no authentication, though it requires user interaction and no public exploit code or active exploitation is recorded. | Update Google Chrome to 156.0.8078.47 or later on all managed endpoints; verify the version via your browser management tooling and restart Chrome to complete the update. | |||
| CVE-2026-113331 | REVIEW | 53 | 29 | 90 | 65 | 8.8 | 37.4 | poc | poc_early | chrome | 2026-10-20 | Memory corruption in Chrome reachable from any crafted HTML page with no authentication, but exploitation is only at proof-of-concept stage, EPSS is 0.4%, and Chromium rates the security severity Low. | Update Google Chrome to 156.0.8078.47 or later from the October 2026 stable channel release; verify the version in chrome://settings/help and restart the browser to complete the update. | |||
| CVE-2026-113146 | REVIEW | 53 | 29 | 90 | 65 | 8.8 | 31.3 | poc | poc_early | chrome | 2026-10-20 | Chrome memory corruption reachable from any crafted HTML page with no authentication, and a public proof-of-concept exists; EPSS is low (0.00385) and no active exploitation is confirmed, so this is a fast-patch item rather than an emergency. | Update Google Chrome to 156.0.8078.47 or later on all managed endpoints and verify the version after the browser restart; prioritise users who browse untrusted content. | |||
| CVE-2026-113141 | REVIEW | 53 | 29 | 90 | 65 | 8.8 | 31.3 | poc | poc_early | chrome | 2026-10-20 | Use-after-free in Chrome reachable from a crafted HTML page with no authentication, and a public proof of concept exists; exploitation in the wild has not been confirmed. | Update Google Chrome to 156.0.8078.47 or later on all managed endpoints and verify the version after restart; prioritise browsers used for general web browsing. | |||
| CVE-2026-113118 | REVIEW | 53 | 29 | 90 | 65 | 8.8 | 27.5 | poc | poc_early | chrome | 2026-10-20 | Chrome memory corruption reachable from a crafted HTML page with no authentication, and proof-of-concept exploitation is noted; impact is code execution inside the sandbox, not full host compromise. | Update Google Chrome to 156.0.8078.47 or later on all endpoints; verify version via chrome://settings/help and restart the browser to complete the update. | |||
| CVE-2026-96654 | ACT_NOW | 52 | 60 | 21 | 65 | 6.5 | 12.6 | Yes | cisa_only | plex | media_server · media server | 2026-09-23 | Listed in CISA KEV, meaning exploitation has been observed. No authentication or user interaction is required, and internet-exposed Plex Media Servers can be reached directly. | Apply the vendor fix: Update Plex Media Server to 1.43.3.10861 or later (1.43.3 and above); NAS users may need to install the package manually if their package manager lags. CISA links the advisory: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319. Until it is applied, identify where media_server is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||
| CVE-2026-113043 | FYI | 51 | 22 | 90 | 70 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome on iOS to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-112996 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later; earlier versions are affected. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113284 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113120 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113272 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later; versions prior to 156.0.8078.47 are affected. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113003 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113314 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113258 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113278 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113288 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113313 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113016 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113308 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113280 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to 156.0.8078.47 or later, per the Chrome stable channel release. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113299 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-112999 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to 156.0.8078.47 or later; versions prior to 156.0.8078.47 are affected. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113032 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome on Android to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113029 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113307 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113020 | FYI | 50 | 23 | 90 | 65 | 9.6 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later, which addresses this flaw. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113123 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later, which fixes this issue. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113013 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113017 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113021 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to 156.0.8078.47 or later, per the Chrome stable channel release. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113031 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome on Windows to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113039 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113055 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome on Android to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113335 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to version 156.0.8078.47 or later; earlier versions are affected. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113269 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113090 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113127 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later; versions prior to 156.0.8078.47 are affected. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113135 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113065 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113275 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113115 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113064 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113024 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113067 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113170 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome on Android to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113281 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to 156.0.8078.47 or later; versions prior to 156.0.8078.47 are affected. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113061 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to 156.0.8078.47 or later, which fixes the Chromoting memory corruption. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113034 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113097 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113053 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome on Android to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113220 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome on Android to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113315 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to 156.0.8078.47 or later, per the Chrome stable channel release. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113302 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113180 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome on Android to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113289 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113294 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113025 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113060 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113124 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113139 | FYI | 50 | 22 | 90 | 65 | 6.5 | poc | poc_early | chrome | 2026-10-20 | CISA SSVC: public proof of concept | Update Google Chrome to version 156.0.8078.47 or later. | ||||
| CVE-2026-113140 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113058 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113131 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to version 156.0.8078.47 or later; all earlier versions are affected. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113311 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113142 | FYI | 50 | 22 | 90 | 65 | 6.5 | poc | poc_early | chrome | 2026-10-20 | CISA SSVC: public proof of concept | Update Google Chrome to version 156.0.8078.47 or later. | ||||
| CVE-2026-113130 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113095 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113079 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later, which addresses the use-after-free in SiteIsolation. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113094 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113324 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113298 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-112997 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113262 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113069 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113033 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113265 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113028 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113290 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113338 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later, which fixes this issue. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-112993 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113259 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113343 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113319 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113132 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113063 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113287 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113080 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113000 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to 156.0.8078.47 or later, per the Chrome stable channel release. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113068 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113344 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113008 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113318 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113062 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113271 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later; versions prior to 156.0.8078.47 are affected. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113015 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113071 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome on Android to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113133 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-112998 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113037 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113306 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later; versions prior to 156.0.8078.47 are affected. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113136 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-91665 | REVIEW | 50 | 31 | 58 | 80 | 9.8 | 32.1 | none | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | Unauthenticated network attack against Oracle Essbase 21.8.3.0.0 can take over the service, but there is no observed exploitation, no public exploit code and EPSS sits at 0.004 – the risk is real only where Essbase is reachable from untrusted networks. | Apply the Oracle Critical Patch Update (October 2026) Essbase patches, using the CPU advisory’s Patch Availability Document to confirm the fixed version; plan a service restart. Until patched, restrict TCP access to Essbase to trusted hosts or place it behind a VPN/WAF. | ||
| CVE-2026-113321 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113327 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113332 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113005 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113011 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome on Windows to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113093 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later; versions prior to 156.0.8078.47 are affected. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113267 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later, which fixes this issue. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113339 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later, which is the fixed release named in the affected-version range. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113316 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113260 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to 156.0.8078.47 or later; versions prior to 156.0.8078.47 are affected. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113291 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113073 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113004 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113027 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113075 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later, which fixes the DevTools use-after-free. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113083 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome on Android to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113273 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113274 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later, which addresses this flaw. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113010 | FYI | 50 | 22 | 90 | 65 | 6.5 | poc | poc_early | chrome | 2026-10-20 | CISA SSVC: public proof of concept | Update Google Chrome to version 156.0.8078.47 or later. | ||||
| CVE-2026-113286 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113076 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome on Android to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113125 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Upgrade Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113001 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113006 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113303 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later; versions prior to 156.0.8078.47 are affected. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113114 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113301 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later, which fixes the WebAppInstalls memory corruption. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113059 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113337 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later, per the Chrome stable channel release. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113305 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113012 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113036 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113074 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome on Windows to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-113279 | FYI | 50 | 22 | 90 | 65 | 8.8 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Apply the vendor fix: Update Google Chrome to version 156.0.8078.47 or later. Until it is applied, identify where chrome is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. Treat this as higher urgency than the tier alone suggests: no authentication is required to reach it. | ||||
| CVE-2026-76290 | FYI | 49 | 18 | 78 | 80 | 7.5 | 33.8 | none | none | splunk | splunk enterprise | 2026-10-21 | CISA SSVC: automatable | Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16 or higher, then enable authentication for Edge Processor package downloads and restart Splunk Enterprise. | ||
| CVE-2026-102503 | REVIEW | 49 | 42 | 45 | 65 | 9.3 | 26.1 | poc | poc_early | sam | 2026-10-19 | Unauthenticated, no-interaction bypass of Biscuit capability policy in the SAM /libp2p-http ingress lets any remote libp2p peer invoke arbitrary backend services, including command/stdio-backed MCP servers. Exploitation is only at proof-of-concept stage and EPSS is low (0.0034). | Upgrade Google OSS Agent Mesh (SAM) to 0.1.0-alpha.3 or later and restart the service. Until upgraded, do not expose the /libp2p-http ingress to untrusted peers; restrict it to trusted networks or place it behind a VPN. | |||
| CVE-2026-105772 | REVIEW | 48 | 34 | 58 | 65 | 9.1 | none | none | adk typescript (@google/adk) | 2026-10-20 | Unauthenticated path traversal in the ADK API server when the non-default FileArtifactService is enabled, allowing file read and write outside the artifact root. No exploitation is observed and no public exploit code exists, so urgency rests on exposure rather than active attacks. | Upgrade @google/adk to 0.6.0 or later. If you cannot upgrade immediately, disable FileArtifactService and use the default InMemoryArtifactService, and keep the ADK API server off the public internet until patched. | ||||
| CVE-2026-113264 | FYI | 48 | 18 | 90 | 65 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||||
| CVE-2026-96652 | ACT_NOW | 47 | 50 | 21 | 65 | 4.3 | 12.0 | Yes | cisa_only | plex | media_server · media server | 2026-09-23 | CISA KEV listing confirms exploitation. Plex Media Server is often internet-facing, and an attacker using any X-Plex-Token value can force it to POST to an arbitrary URL, creating an SSRF path into internal networks. | Apply the vendor fix: Update Plex Media Server to 1.43.3.10861 or later; NAS users whose package manager lags can install the package manually. CISA links the advisory: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319. Until it is applied, identify where media_server is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. | ||
| CVE-2026-96655 | ACT_NOW | 47 | 50 | 21 | 65 | 4.3 | 12.0 | Yes | cisa_only | plex | media_server · media server | 2026-09-23 | CISA KEV listing on 2026-10-20 means exploitation has been observed in the wild, not just theorised. Plex Media Servers are routinely published to the internet, and the flaw lets an authenticated user make the server fetch arbitrary internal or external addresses, reaching services behind the perimeter. | Apply the vendor fix: Update Plex Media Server to 1.43.3.10861 or later; NAS users may need to install the package manually if their package manager has not yet updated. CISA links the advisory: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319. Until it is applied, identify where media_server is deployed and exposed, then remove it from direct internet exposure – put it behind the VPN, a WAF or an IP allowlist. | ||
| CVE-2026-20236 | FYI | 46 | 8 | 86 | 80 | 7.5 | 26.9 | none | none | cisco | cisco cyber vision · cisco open source snort3 · cisco secure firewall threat defense (ftd) software +1 more | 2026-10-21 | CISA SSVC: automatable | Cisco hardening releases address these Snort 3 issues; see Cisco Security Advisory cisco-sa-hardening-snort3-ybgmhTQe for the fixed versions for each affected product. | ||
| CVE-2026-110264 | REVIEW | 46 | 31 | 78 | 45 | 10.0 | 42.2 | none | none | gitlab | gitlab | 2026-10-22 | Unauthenticated remote code execution in GitLab via a crafted regex, CVSS 10.0, affecting every version from 7.0 onward. No exploitation is observed yet and EPSS is low (0.005), so this is a patch-window problem rather than an active incident. | Upgrade GitLab to 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 or 19.5.1 (or later). Plan the restart window now; until patched, restrict internet exposure of self-managed instances to trusted networks or a WAF. | ||
| CVE-2026-103091 | REVIEW | 46 | 30 | 58 | 65 | 9.3 | 33.5 | poc | poc_early | sam | 2026-10-19 | Pre-auth, no-interaction flaw in Google SAM’s MCP proxy lets any OIDC token holder self-enroll and reach every connected backend tool with full read/write/execute. Exploitation is only at proof-of-concept stage and EPSS is 0.4%, but the deployment base is niche alpha software. | Upgrade Google OSS Agent Mesh (SAM) to 0.1.0-alpha.9 or later, which enforces fail-closed default policy, explicit policy binding on enrollment and ban checks; restart the service. Until upgraded, restrict /info and /register to trusted networks and audit mesh enrollments. | |||
| CVE-2026-76474 | REVIEW | 45 | 31 | 58 | 60 | 9.8 | 28.2 | none | none | cisco | cisco emergency responder · cisco unified communications manager im and presence service · cisco unity connection | 2026-10-21 | Pre-authentication, no-user-interaction flaw (CVSS 9.8) in Cisco voice infrastructure, but exploitation is unconfirmed: no KEV listing, no public exploit code, EPSS 0.0036, and the affected products are niche deployments rather than broad internet-facing estate. | Apply the hardening releases listed in Cisco advisory cisco-sa-voice-hardening-twgbH9e3 for each affected product (Emergency Responder, Unified CM, IM&P, Unity Connection); schedule the downtime. Until patched, keep these systems off direct internet exposure and restrict management access to trusted networks. | ||
| CVE-2026-92559 | REVIEW | 45 | 31 | 38 | 80 | 9.8 | 44.5 | none | none | ibm | app connect enterprise | 2026-10-20 | Pre-authentication, no-user-interaction flaw in IBM App Connect Enterprise with a CVSS of 9.8, but no exploitation signal exists yet: EPSS is 0.0053, no KEV entry, and no public exploit or detection template. | Apply IBM App Connect Enterprise Fix Pack 13.0.9.0 (APAR IT50100) from IBM Support; the fix requires a service restart, so schedule it. Until then, restrict access to the affected listener to trusted networks. | ||
| CVE-2026-76288 | FYI | 45 | 18 | 78 | 65 | 7.5 | 29.9 | none | none | splunk | splunk enterprise | 2026-10-21 | CISA SSVC: automatable | Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16 or higher; disabling Splunk Web is a workaround. | ||
| CVE-2026-20043 | REVIEW | 45 | 7 | 86 | 80 | 9.0 | 17.3 | none | none | cisco | cisco cyber vision · cisco open source snort3 · cisco secure firewall threat defense (ftd) software +1 more | 2026-10-21 | Pre-auth, no-user-interaction out-of-bounds writes in Snort 3, which sits inline in Cisco FTD and UTD IPS deployments; CVSS 9.0, though the vector requires high attack complexity and no exploitation signal exists yet. | Apply the Cisco hardening releases listed in advisory cisco-sa-hardening-snort3-ybgmhTQe for each affected product (FTD, UTD Snort IPS, Cyber Vision, open source Snort 3); plan for a service restart. Until patched, limit management and IPS-path exposure to trusted networks. | ||
| CVE-2026-113030 | FYI | 44 | 10 | 90 | 65 | 8.8 | 15.3 | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Update Google Chrome to version 156.0.8078.47 or later. | ||||
| CVE-2026-91664 | FYI | 44 | 18 | 58 | 80 | 7.5 | 20.9 | none | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | CISA SSVC: automatable | Apply the Oracle Critical Patch Update (October 2026) patches for Oracle Essbase; see the CPU advisory and its Patch Availability Document for the fixed version. | ||
| CVE-2026-113057 | FYI | 44 | 10 | 90 | 65 | 8.8 | 14.0 | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix. | ||||
| CVE-2026-113143 | FYI | 44 | 10 | 90 | 65 | 8.8 | 11.9 | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | Update Google Chrome to version 156.0.8078.47 or later. | ||||
| CVE-2026-83938 | FYI | 44 | 26 | 75 | 50 | 10.0 | 53.1 | none | none | microsoft | azure kubernetes configuration service | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-99064 | FYI | 43 | 0 | 98 | 73 | 8.1 | 43.6 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to Linux 6.12.113, 6.18.57 or 7.2.11 or later; kernels before 6.10 are unaffected. | |||
| CVE-2026-98968 | FYI | 43 | 0 | 98 | 73 | 8.1 | 42.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | Apply the kernel stable updates containing the fix: 6.6.160, 6.12.113 or 6.18.57 and later (commit 95114e421196 and its stable backports). | |||
| CVE-2026-20291 | FYI | 42 | 0 | 86 | 80 | 7.8 | 1.8 | none | none | cisco | cisco cyber vision · cisco open source snort3 · cisco secure firewall threat defense (ftd) software +1 more | 2026-10-21 | CISA SSVC: total technical impact | Cisco hardening releases address these Snort 3 privilege management flaws; see Cisco Security Advisory cisco-sa-hardening-snort3-ybgmhTQe for the fixed versions per product. | ||
| CVE-2026-97785 | FYI | 42 | 26 | 75 | 40 | 10.0 | 50.7 | none | none | microsoft | microsoft entra application proxy | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-110063 | FYI | 42 | 26 | 75 | 40 | 10.0 | 59.1 | none | none | microsoft | vm inspector for azure virtual machines | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-93441 | FYI | 42 | 25 | 38 | 80 | 8.6 | none | none | ibm | qradar security information and event management | 2026-10-20 | CISA SSVC: automatable | Apply the HTTP Receiver RPMs: PROTOCOL-HTTPReceiver-7.5-20260930064859 for 7.5 and PROTOCOL-HTTPReceiver-7.6-20260930064911 for 7.6, available from IBM Fix Central. | |||
| CVE-2026-112390 | FYI | 42 | 12 | 78 | 65 | 7.5 | 48.0 | poc | poc_early | python, python-pillow | pillow | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | Upgrade Pillow to version 13.0.0 or later. | ||
| CVE-2026-76489 | FYI | 41 | 17 | 86 | 45 | 5.8 | 23.3 | none | none | cisco | cisco open source snort3 · cisco secure firewall threat defense (ftd) software | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-98980 | FYI | 41 | 0 | 90 | 73 | 8.8 | 7.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | Apply the upstream kernel stable patches (e.g. commits e2b10181d913, 5f97df8ca7fa, b43ff2deef48, 8189ab688f5a); fixed in 6.12.113, 6.18.57 and 7.2.11 or later. | |||
| CVE-2026-98981 | FYI | 41 | 0 | 90 | 73 | 8.8 | 5.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | Apply the kernel stable updates containing the fix: 6.6.160, 6.12.114 or 6.18.57 and later (or the corresponding upstream commit). | |||
| CVE-2026-112292 | FYI | 41 | 36 | 13 | 80 | 9.8 | none | none | operacle | checkcle | 2026-10-19 | Unauthenticated attackers can read, modify and delete records in CheckCle’s shipped PocketBase collections, exposing server_token values and alert_configuration secrets. No exploitation has been observed and no public exploit code is known. | No fix information found; check the vendor advisory. Until then, restrict /api/collections/*/records to trusted networks or a WAF, rotate any exposed server_token and alert_configuration secrets, and verify PocketBase collection API rules are not left empty. | |||
| CVE-2026-20019 | FYI | 41 | 17 | 86 | 45 | 5.8 | 34.8 | none | none | cisco | cisco open source snort3 · cisco secure firewall threat defense (ftd) software · cisco utd snort ips engine software | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-112832 | REVIEW | 41 | 36 | 13 | 80 | 9.8 | none | none | cozythemes | rootblox | 2026-10-22 | Unauthenticated remote file inclusion in a WordPress plugin with a CVSS of 9.8 and a published fix; no exploitation, exploit code or detection template has been observed, and the plugin is niche, so exposure is limited to sites running Rootblox 1.0.6 or earlier. | Update the Rootblox plugin to 1.0.7 or later, then restart the service. If you cannot patch immediately, deactivate the plugin or block requests to its PHP files at the WAF, and check logs for include/require abuse. | |||
| CVE-2026-98978 | FYI | 41 | 0 | 90 | 73 | 8.4 | 6.3 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | Apply the upstream kernel patches (commits 6b8dc3713a76, d23265a12e49, f78ddcc87224); fixed in 6.18.57 and later, 7.2.11 and later, and 7.3 and later. | |||
| CVE-2026-112894 | FYI | 41 | 32 | 33 | 65 | 8.7 | 20.4 | poc | poc_early | python-pillow | pillow | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | Upgrade Pillow to version 13.0.0 or later; all versions from 5.1.0 up to but excluding 13.0.0 are affected. | ||
| CVE-2026-105014 | FYI | 41 | 24 | 75 | 40 | 9.1 | 51.6 | none | none | microsoft | azure pipelines | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-20218 | FYI | 41 | 17 | 86 | 45 | 5.8 | 34.8 | none | none | cisco | cisco open source snort3 · cisco secure firewall threat defense (ftd) software · cisco utd snort ips engine software | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-86919 | FYI | 41 | 7 | 90 | 58 | 8.8 | 7.8 | none | none | apple | ios and ipados · macos · visionos | 2026-10-20 | CISA SSVC: total technical impact | Update to iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, or visionOS 27. | ||
| CVE-2026-15723 | FYI | 41 | 10 | 78 | 65 | 8.2 | 36.2 | none | none | gitlab | gitlab | 2026-10-22 | CISA SSVC: total technical impact | Upgrade to GitLab 19.3.6, 19.4.3, 19.5.1 or above. | ||
| CVE-2026-76445 | FYI | 41 | 17 | 86 | 45 | 5.3 | 34.8 | none | none | cisco | cisco open source snort3 · cisco secure firewall threat defense (ftd) software · cisco utd snort ips engine software | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-20197 | FYI | 41 | 17 | 86 | 45 | 5.8 | 31.9 | none | none | cisco | cisco open source snort3 · cisco secure firewall threat defense (ftd) software · cisco utd snort ips engine software | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-99082 | FYI | 41 | 0 | 90 | 73 | 8.8 | 4.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | Apply the upstream kernel fix (commits a63f79d9da94, 7fd4e64f4bbc, 2566780c684c, e792a9ace39d, b3e6212dea2e); fixed in 6.6.160, 6.12.114 and 6.18.58 or later. | |||
| CVE-2026-111183 | REVIEW | 41 | 26 | 33 | 80 | 9.8 | 53.0 | none | none | gstreamer | gstreamer | 2026-10-21 | Pre-authentication heap overflow in GStreamer’s rtpL16depay with CVSS 9.8 and a fix already committed upstream, but no exploitation signal: EPSS 0.007, no KEV, no public exploit or detection template. | Update GStreamer to a release containing commit 80c184b4c5ee8ba28b2540ba58f40b8d44b61622, then restart services that link it. Where RTP L16 streams are parsed from untrusted networks, restrict that input until the update is deployed. | ||
| CVE-2026-109432 | REVIEW | 41 | 43 | 13 | 65 | 9.8 | poc | poc_early | camunda | camunda 7 | 2026-10-19 | Pre-auth CVSS 9.8 with a stated fix, but exploitation is only at proof-of-concept stage and no KEV, Metasploit or ExploitDB entry exists; the description also indicates an authenticated attacker is needed, which tempers the vector. | Upgrade Camunda 7 to 7.24.14 or later, or 7.23.17 or later, and restart the service. Until patched, restrict the REST/TaskQuery endpoint to trusted networks and keep enableExpressionsInAdhocQueries disabled where possible. | |||
| CVE-2026-43844 | REVIEW | 41 | 30 | 38 | 65 | 9.3 | 33.9 | none | none | advantech | adam-3600 | 2026-10-20 | An authentication bypass in the ADAM-3600’s proprietary protocol is reachable over the network with no credentials and no user interaction (CVSS 9.3), though no exploitation has been observed and EPSS sits at 0.0041. | Update ADAM-3600 firmware to 2.8.5.0 or later (versions prior to 2.8.5.0 are affected); the update restarts the service, so schedule it. Until then, keep these controllers off the public internet and behind a firewall or VPN. | ||
| CVE-2023-7356 | FYI | 41 | 0 | 90 | 73 | 8.8 | 20.9 | none | linux | linux | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to Linux kernel 6.1.178, 6.6.145, or 6.7 or later; the fix is in stable commits ba25efe15e8f, 927ef409f713 and f4da3ee15de9. | |||
| CVE-2026-96365 | FYI | 41 | 18 | 78 | 50 | 7.5 | 8.2 | none | none | drupal | webform | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-98959 | FYI | 41 | 0 | 90 | 73 | 9.8 | 48.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to a kernel containing the btrfs fix: 6.6.160 or later, 6.12.113 or later, or 6.18.57 or later (stable commits 7a53bb4, 5877d71, a97114b, c180369, 858bee1). | |||
| CVE-2026-112400 | FYI | 41 | 32 | 33 | 65 | 8.7 | 20.4 | poc | poc_early | python-pillow | pillow | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | Upgrade Pillow to version 13.0.0 or later, which fixes the issue. | ||
| CVE-2026-20179 | FYI | 41 | 17 | 86 | 45 | 5.8 | 31.9 | none | none | cisco | cisco open source snort3 · cisco secure firewall threat defense (ftd) software · cisco utd snort ips engine software | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-98988 | FYI | 41 | 0 | 90 | 73 | 8.8 | 5.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | Apply the kernel stable fixes b8a94a405ddcf45e9470789e0a821d8f2aa4ca10 and 0febe278ec45b1ccdbe9bd5ff1ba365d8fd55e2a; fixed in 7.2.11 and later and in 7.3. | |||
| CVE-2026-20011 | FYI | 41 | 17 | 86 | 45 | 5.8 | 34.8 | none | none | cisco | cisco open source snort3 · cisco secure firewall threat defense (ftd) software · cisco utd snort ips engine software | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-113703 | FYI | 40 | 47 | 0 | 65 | 9.3 | poc | poc_early | giuseppe99barchetta | suggestarr | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | Upgrade to SuggestArr 3.0.0 or later, which addresses the authentication bypass. | |||
| CVE-2026-108456 | FYI | 40 | 14 | 83 | 49 | 7.7 | 52.9 | none | none | microsoft | azure ai foundry | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-94075 | REVIEW | 40 | 31 | 33 | 65 | 9.8 | 38.8 | none | none | tribulant software | newsletters | 2026-10-24 | Unauthenticated PHP object injection in a widely deployed WordPress plugin, reachable over the internet with no user interaction; no exploitation, exploit code or detection template has been observed, and EPSS sits at 0.45%. | Update the Tribulant Newsletters plugin to 4.18.2 or later, then restart the service. If you cannot patch promptly, deactivate the plugin or restrict wp-admin and plugin endpoints to trusted networks. | ||
| CVE-2026-91644 | FYI | 40 | 10 | 58 | 80 | 9.3 | 14.1 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | Apply the Oracle Critical Patch Update (October 2026) patches for Oracle Essbase; see the Oracle CPU advisory for patch availability and installation instructions. | |||
| CVE-2021-48014 | FYI | 40 | 48 | 13 | 50 | 9.8 | 80.9 | poc | poc_early | fanruan | finereport | 2026-10-22 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-113802 | FYI | 40 | 48 | 13 | 50 | 9.8 | poc | poc_early | wavlink | wl-wn530be1-a | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-112241 | REVIEW | 40 | 31 | 33 | 65 | 9.8 | 26.9 | none | none | brainstorm force | surecart | 2026-10-22 | Pre-authentication authentication bypass in a widely deployed WordPress e-commerce plugin, reachable over the internet with no user interaction; no public exploit code or active exploitation is recorded, and EPSS is low at 0.00346. | Update the SureCart plugin to at least version 4.9.6 and restart the service. Until patched, restrict wp-admin and plugin endpoints to trusted networks or place the site behind a WAF, and review logs for anomalous authentication activity. | ||
| CVE-2026-76293 | FYI | 40 | 8 | 78 | 65 | 7.2 | 40.4 | none | none | splunk | splunk enterprise | 2026-10-21 | CISA SSVC: total technical impact | Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16 or higher. | ||
| CVE-2026-99083 | FYI | 40 | 5 | 78 | 73 | 8.8 | 34.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to Linux 6.6.160, 6.12.114 or 6.18.58 or later, which include the fix subtracting work->next_smb2_rsp_hdr_off when computing out_len. | |||
| CVE-2026-86922 | FYI | 39 | 17 | 90 | 30 | 8.8 | 2.6 | none | none | apple | safari · ios and ipados · macos +1 more | 2026-10-20 | CISA SSVC: total technical impact | Fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, and visionOS 27; upgrade to those versions or later. | ||
| CVE-2026-76300 | FYI | 39 | 7 | 78 | 65 | 8.8 | 6.0 | none | none | splunk | splunk enterprise | 2026-10-21 | CISA SSVC: total technical impact | Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16 or higher. | ||
| CVE-2026-76493 | FYI | 39 | 18 | 58 | 60 | 7.5 | 17.1 | none | none | cisco | cisco telepresence video communication server (vcs) expressway | 2026-10-21 | CISA SSVC: automatable | Apply the Cisco Expressway Series software hardening release referenced in Cisco Security Advisory cisco-sa-exwy-hardening-FhcqBVcs; the advisory does not name specific fixed versions. | ||
| CVE-2026-114196 | REVIEW | 39 | 31 | 13 | 80 | 9.8 | 38.8 | none | none | paytiumsupport | paytium | 2026-10-24 | Unauthenticated PHP object injection in a WordPress plugin, CVSS 9.8 with a vendor fix already shipped, but no exploitation signal exists yet (EPSS 0.4%, no KEV, no public exploit code). | Update the Paytium plugin to 5.0.6 or later, then check for and remove any unused Paytium installs. If you cannot patch promptly, deactivate the plugin until it is updated. | ||
| CVE-2026-112391 | FYI | 39 | 0 | 70 | 85 | 7.5 | 47.5 | none | none | python, python-pillow | pillow | 2026-10-19 | no exploitation evidence in any monitored source | Upgrade Pillow to 13.0.0 or later, which sets the PdfParser default max_nesting limit to 900. | ||
| CVE-2026-78162 | REVIEW | 39 | 38 | 13 | 65 | 10.0 | poc | poc_early | apache software foundation | apache camel | 2026-10-19 | Unauthenticated RCE (CVSS 10.0) in Apache Camel’s camel-hazelcast component, reachable by anyone who can publish into the attached Hazelcast cluster, which has no auth or TLS by default. Exploitation is not confirmed; SSVC rates it PoC-only. | Upgrade to Apache Camel 4.23.0, or 4.22.1 on the 4.22.x stream / 4.18.5 on 4.18.x. The 4.14.x and earlier streams are end of life and will not be fixed – migrate off them. Until patched, enable authentication and TLS on Hazelcast clusters and restrict network access to them. | |||
| CVE-2026-85267 | FYI | 39 | 16 | 38 | 85 | 8.7 | 11.9 | none | none | google cloud | cloud shell | 2026-10-20 | CISA SSVC: total technical impact | Google patched Cloud Shell on 22 July 2026; versions prior to 2026-07-22 are affected and no customer action is needed. | ||
| CVE-2026-76466 | FYI | 38 | 21 | 70 | 40 | 9.8 | 30.9 | none | none | cisco | cisco telepresence video communication server (vcs) expressway | 2026-10-21 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-101356 | REVIEW | 38 | 26 | 33 | 65 | 9.1 | none | none | apache software foundation | apache tomcat | 2026-10-20 | Pre-auth, no-user-interaction HTTP/2 flaw in Tomcat can mix up requests and responses between users, leaking one user’s data to another. No exploitation is confirmed and no public exploit code exists, but the affected versions are widely deployed. | Upgrade Apache Tomcat to 11.0.27, 10.1.61 or 9.0.123 (restart required). If you cannot patch immediately, disable HTTP/2 or restrict it to trusted clients until the upgrade is in place. | |||
| CVE-2026-99079 | FYI | 38 | 0 | 78 | 73 | 9.8 | 39.3 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to Linux 6.6.160, 6.12.113 or 6.18.57 or later (or apply the referenced stable commits), which mark the WQE as released immediately after the driver-side free. | |||
| CVE-2026-103119 | REVIEW | 38 | 26 | 33 | 65 | 9.1 | none | none | apache software foundation | apache tomcat | 2026-10-20 | Pre-authentication, no user interaction, CVSS 9.1 buffer under-read in Apache Tomcat 11.0.0-M25 through 11.0.26 can split a response body across requests, potentially leaking data from one response into the next. No exploitation has been observed and no public exploit code or detection template exists. | Upgrade Apache Tomcat to 11.0.27 or later, which fixes the issue; the change requires a service restart, so schedule it in a maintenance window. Until then, restrict access to affected Tomcat instances to trusted networks. | |||
| CVE-2026-113263 | FYI | 38 | 8 | 70 | 65 | 9.6 | 33.2 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to version 156.0.8078.47 or later. | |||
| CVE-2026-99042 | FYI | 38 | 0 | 78 | 73 | 8.4 | 5.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to Linux 7.2.11 or later, or 7.3 or later; the fix uses SIN6_LEN_RFC2133 as the length threshold in io_connect_bpf_populate(). | |||
| CVE-2026-20356 | FYI | 38 | 8 | 86 | 49 | 7.5 | 26.9 | none | none | cisco | cisco cyber vision · cisco open source snort3 · cisco secure firewall threat defense (ftd) software +1 more | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-98870 | FYI | 38 | 0 | 78 | 73 | 8.8 | 45.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | Apply the upstream kernel stable patches (e.g. commits f8200bb4994e, 9cd6d714d3ca, b145f9b56c87, a15cae16f443, b10665730fbf) that remove the conn->binding gate in ksmbd_sessions_deregister(). | |||
| CVE-2026-99078 | FYI | 38 | 0 | 78 | 73 | 9.8 | 39.3 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | Update to Linux 6.6.160, 6.12.113 or 6.18.57 or later (or apply the corresponding stable commits), which set all skip_release_bitmap bits in the mlx5e_xsk_alloc_rx_mpwqe() error path. | |||
| CVE-2026-91656 | FYI | 37 | 5 | 58 | 80 | 9.1 | 13.0 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | Apply the Essbase security patch in Oracle’s October 2026 Critical Patch Update; see the CPU advisory and its Patch Availability Document for the fixed version. | |||
| CVE-2026-91653 | FYI | 37 | 5 | 58 | 80 | 8.5 | 11.1 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | Apply the Essbase security patch in Oracle’s October 2026 Critical Patch Update; see the CPU advisory and its Patch Availability Document for the fixed version. | |||
| CVE-2026-113249 | FYI | 37 | 7 | 70 | 65 | 8.8 | 32.1 | none | none | google, apple | chrome · iphone_os | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on iOS to 156.0.8078.47 or later. | ||
| CVE-2026-91655 | FYI | 37 | 5 | 58 | 80 | 9.1 | 13.6 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | Apply the Essbase security patch from Oracle’s October 2026 Critical Patch Update (cpuoct2026); see the advisory’s patch availability document for the exact version. | |||
| CVE-2026-113243 | FYI | 37 | 7 | 70 | 65 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, per the Chrome stable channel release. | |||
| CVE-2026-109442 | FYI | 37 | 48 | 0 | 50 | 9.8 | 52.1 | poc | poc_early | cas-bigdatalab | piflow | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-113276 | FYI | 37 | 7 | 70 | 65 | 8.8 | 28.4 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-77932 | FYI | 37 | 43 | 13 | 50 | 9.8 | 49.9 | poc | poc_early | eosphoros-ai | db-gpt | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-82891 | FYI | 37 | 15 | 38 | 80 | 8.1 | 42.8 | none | none | ibm | guardium data protection | 2026-10-20 | CISA SSVC: total technical impact | IBM directs Guardium Data Protection 12.1 customers to the SqlGuard_12.0p150_Bundle fix via IBM Fix Central; see IBM advisory node/7293014 for the 12.2 fix. | ||
| CVE-2026-113870 | FYI | 37 | 0 | 78 | 70 | 8.8 | 14.1 | none | mongodb | compass | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade MongoDB Compass to 1.49.15 or later, which addresses the improper escaping of BSON values. | |||
| CVE-2026-107081 | FYI | 37 | 43 | 13 | 50 | 9.8 | poc | poc_early | n/a | n/a | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-113250 | FYI | 37 | 7 | 70 | 65 | 8.8 | 28.2 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-107083 | FYI | 37 | 43 | 13 | 50 | 9.8 | poc | poc_early | n/a | n/a | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-112994 | FYI | 37 | 7 | 70 | 65 | 8.8 | 43.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113238 | FYI | 37 | 7 | 70 | 65 | 8.8 | 28.4 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-96355 | FYI | 37 | 19 | 70 | 40 | 9.1 | 36.1 | none | none | drupal | webform | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-75128 | FYI | 37 | 43 | 13 | 50 | 9.8 | 43.2 | poc | poc_early | chatchat-space | langchain-chatchat | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-113099 | FYI | 37 | 7 | 70 | 65 | 8.8 | 36.4 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to version 156.0.8078.47 or later. | |||
| CVE-2026-111755 | FYI | 37 | 24 | 33 | 65 | 8.2 | poc | poc_early | follow-redirects | follow-redirects | 2026-10-19 | CISA SSVC: public proof of concept | Upgrade follow-redirects to version 1.16.1 or later. | |||
| CVE-2026-113092 | FYI | 37 | 7 | 70 | 65 | 8.8 | 36.4 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-112327 | REVIEW | 36 | 22 | 33 | 65 | 9.3 | 14.4 | none | none | tms | amelia | 2026-10-22 | Unauthenticated SQL injection in a widely deployed WordPress booking plugin, reachable over the internet with no user interaction; no exploitation has been observed and EPSS is low at 0.00241, so this is a patch-soon item rather than an emergency. | Update the Amelia plugin to version 2.4.12 or later, then restart the service. If you cannot patch promptly, restrict access to the booking endpoints behind a WAF or trusted networks and review database logs for injection attempts. | ||
| CVE-2026-91637 | FYI | 36 | 9 | 70 | 55 | 9.9 | 28.2 | none | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | CISA SSVC: total technical impact | Apply the Oracle Critical Patch Update (October 2026) patches for Oracle Essbase; see the CPU advisory and its Patch Availability Document for the fixed version. | ||
| CVE-2026-43836 | REVIEW | 36 | 30 | 38 | 45 | 9.3 | 47.8 | none | none | advantech | adam-3600 | 2026-10-20 | Pre-authentication, no-user-interaction command execution (CVSS 9.3) on an internet-exposed Advantech ADAM-3600 controller, with a firmware fix available. No exploitation, exploit code or detection template has been observed, so this is exposure-driven rather than active-threat urgency. | Update ADAM-3600 firmware to 2.8.5.0 or later; all versions prior to 2.8.5.0 are affected. Schedule the downtime, and until then remove the device from direct internet exposure – place it behind a VPN or firewall allowlist restricted to trusted hosts. | ||
| CVE-2026-76491 | FYI | 36 | 18 | 58 | 49 | 7.5 | 17.1 | none | none | cisco | cisco telepresence video communication server (vcs) expressway | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-76473 | REVIEW | 36 | 21 | 58 | 44 | 9.8 | 28.1 | none | none | cisco | cisco emergency responder · cisco unified communications manager im and presence service · cisco unity connection | 2026-10-21 | Pre-authentication, no-user-interaction flaws (CVSS 9.8) in Cisco voice infrastructure, fixed by hardening releases. No public exploit code, KEV listing or confirmed exploitation, and EPSS sits at 0.0036, so this is a scheduled-patch item rather than an emergency. | Apply the fixed release named in Cisco advisory cisco-sa-voice-hardening-twgbH9e3 for each affected product (Emergency Responder, Unified CM, IM & Presence, Unity Connection). Plan the upgrade window now; these are major-version moves, so stage and test before rollout. | ||
| CVE-2026-77933 | FYI | 36 | 43 | 13 | 45 | 9.8 | 27.1 | poc | poc_early | eosphoros-ai | db-gpt | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-77936 | FYI | 36 | 43 | 13 | 45 | 9.8 | 39.4 | poc | poc_early | letta-ai | letta | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-10743 | FYI | 36 | 7 | 48 | 80 | 8.8 | 20.6 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | CISA SSVC: total technical impact | Addressed in IBM MQ Operator v4.1.0; affected versions are 3.2.0 through 3.2.29 and 3.3.0 up to (but not including) 3.4.0. | ||
| CVE-2026-112405 | FYI | 36 | 22 | 33 | 65 | 8.7 | 20.4 | poc | poc_early | python-pillow | pillow | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | Upgrade Pillow to version 13.0.0 or later; versions 12.0.0 through 12.x are affected. | ||
| CVE-2026-20221 | FYI | 36 | 7 | 78 | 50 | 5.8 | 38.4 | none | none | cisco | cisco cyber vision · cisco open source snort3 · cisco secure firewall threat defense (ftd) software +2 more | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-91658 | FYI | 36 | 9 | 70 | 55 | 9.9 | 27.4 | none | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | CISA SSVC: total technical impact | Apply the Oracle Essbase security patch from the October 2026 Critical Patch Update; see the CPU patch availability documentation for the supported version. | ||
| CVE-2026-91638 | FYI | 36 | 9 | 70 | 55 | 9.9 | 33.9 | none | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | CISA SSVC: total technical impact | Apply the Oracle Critical Patch Update (October 2026) patches for Oracle Essbase; see the CPU advisory and its Patch Availability Document. | ||
| CVE-2026-111402 | REVIEW | 36 | 22 | 33 | 65 | 9.3 | 28.2 | none | none | tribulant software | newsletters | 2026-10-24 | Unauthenticated SQL injection in a widely deployed WordPress plugin, reachable over the internet with no user interaction; no exploitation is confirmed yet (EPSS 0.35%, no public exploit or detection template), but a fixed version exists. | Update the Tribulant Newsletters plugin to version 4.18.2 or later, then restart the service. If you cannot patch immediately, restrict wp-admin/plugin endpoints to trusted networks or place the site behind a WAF. | ||
| CVE-2026-112397 | FYI | 36 | 22 | 33 | 65 | 8.7 | 36.6 | poc | poc_early | python-pillow | pillow | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | Upgrade Pillow to version 13.0.0 or later. | ||
| CVE-2026-101296 | REVIEW | 36 | 22 | 33 | 65 | 9.1 | none | none | apache software foundation | apache tomcat | 2026-10-20 | Authentication bypass in Apache Tomcat’s JNDI realm lets an unauthenticated remote attacker log in without the correct password, but it only applies where a non-GSSAPI SASL mechanism is configured, and no exploitation has been observed. | Upgrade to Apache Tomcat 11.0.27, 10.1.61 or 9.0.123 and restart the service. If you cannot patch immediately, confirm whether the JNDI realm is configured with a non-GSSAPI SASL mechanism and disable that configuration until the upgrade lands. | |||
| CVE-2026-76492 | FYI | 36 | 18 | 58 | 49 | 7.5 | 17.1 | none | none | cisco | cisco telepresence video communication server (vcs) expressway | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-112402 | FYI | 36 | 22 | 33 | 65 | 8.7 | 36.6 | poc | poc_early | python-pillow | pillow | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | Upgrade to Pillow 13.0.0 or later; versions prior to 13.0.0 are affected. | ||
| CVE-2026-111812 | REVIEW | 36 | 31 | 18 | 65 | 10.0 | 29.6 | none | none | apache software foundation | apache traffic server | 2026-10-21 | Pre-authentication, no user interaction, CVSS 10.0 in Apache Traffic Server’s origin_server_auth plugin, letting a client force signing of attacker-chosen AWS headers under the proxy’s own credentials. No exploitation observed and EPSS is low, but the deployment base is niche. | Upgrade Apache Traffic Server to 9.2.16, 10.1.5, or 10.2.1 (restart required). If you cannot patch promptly, restrict the origin_server_auth plugin to trusted origins or disable it until the upgrade is applied. | ||
| CVE-2026-91663 | FYI | 36 | 9 | 70 | 55 | 9.9 | 27.4 | none | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | CISA SSVC: total technical impact | Apply the Oracle Critical Patch Update (October 2026) patches for Oracle Essbase; see the CPU advisory and its Patch Availability Document for the fixed version. | ||
| CVE-2026-115214 | FYI | 35 | 31 | 13 | 65 | 9.8 | 3.1 | none | none | unknown | datawiza proxy auth plugin | 2026-10-25 | CISA SSVC: automatable; CISA SSVC: total technical impact | Upgrade the Datawiza Proxy Auth Plugin to version 1.1.1 or later. | ||
| CVE-2026-103090 | FYI | 35 | 10 | 53 | 65 | 8.8 | 25.6 | none | sam | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to SAM 0.1.0-alpha.9 or later, which requires proof of possession of the enrollment private key, adds rate limiting, and validates router lease addresses. | ||||
| CVE-2026-113048 | FYI | 35 | 7 | 70 | 55 | 8.8 | 24.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix. | |||
| CVE-2026-113252 | FYI | 35 | 8 | 70 | 55 | 9.6 | 37.0 | none | none | google, microsoft | chrome · windows | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Windows to 156.0.8078.47 or later. | ||
| CVE-2026-113242 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | google, microsoft | chrome · windows | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Windows to 156.0.8078.47 or later. | ||
| CVE-2026-113320 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | google, apple | chrome · iphone_os | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on iOS to 156.0.8078.47 or later. | ||
| CVE-2026-113317 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | google, apple | chrome · macos | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on macOS to 156.0.8078.47 or later. | ||
| CVE-2026-113167 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, as described in the October 2026 Stable Channel update. | |||
| CVE-2026-113175 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.2 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later via the Stable Channel update. | |||
| CVE-2026-113176 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.2 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, as listed in the October 2026 Stable Channel update. | |||
| CVE-2026-113187 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix. | |||
| CVE-2026-113188 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113235 | FYI | 35 | 8 | 70 | 55 | 9.6 | 37.0 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113293 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | google, microsoft | chrome · windows | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Windows to 156.0.8078.47 or later. | ||
| CVE-2026-109437 | REVIEW | 35 | 31 | 13 | 65 | 9.8 | 48.2 | poc | poc_early | cognicellai | cognition | 2026-10-19 | Unauthenticated RCE via the REST/SSE API with a CVSS 9.8 vector, but EPSS is 0.006 and SSVC marks it non-automatable with no confirmed exploitation; the product is niche, so exposure is likely limited to a small set of deployments. | Upgrade to Cognition 0.13.0 or later, which defaults the local sandbox backend off unless COGNITION_ALLOW_UNSAFE_LOCAL_EXECUTION is set true. Until then, keep the REST/SSE API off the internet and restrict it to trusted networks. | ||
| CVE-2026-113182 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113292 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to version 156.0.8078.47 or later. | |||
| CVE-2026-113100 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix. | |||
| CVE-2026-113087 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix. | |||
| CVE-2026-113226 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113185 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113244 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113049 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, as described in the October 2026 Stable Channel update. | |||
| CVE-2026-113150 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, per the October 2026 Stable Channel release. | |||
| CVE-2026-113312 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | google, apple | chrome · macos | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on macOS to version 156.0.8078.47 or later. | ||
| CVE-2026-113149 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113148 | FYI | 35 | 7 | 70 | 55 | 8.8 | 34.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113241 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113336 | FYI | 35 | 8 | 70 | 55 | 9.6 | 41.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix for this issue. | |||
| CVE-2026-113227 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113181 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113330 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113126 | FYI | 35 | 8 | 70 | 55 | 9.6 | 38.3 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which fixes this issue. | |||
| CVE-2026-113228 | FYI | 35 | 7 | 70 | 55 | 8.8 | 24.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113184 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, as listed in the October 2026 Stable Channel Update for Desktop. | |||
| CVE-2026-113239 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Chrome for Android to 156.0.8078.47 or later, per the October 2026 stable channel release. | |||
| CVE-2026-113240 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113234 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix for this issue. | |||
| CVE-2026-113207 | FYI | 35 | 7 | 70 | 55 | 8.8 | 35.7 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113145 | FYI | 35 | 7 | 70 | 55 | 8.8 | 39.0 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113221 | FYI | 35 | 7 | 70 | 55 | 8.8 | 24.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113236 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | google, apple | chrome · iphone_os | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on iOS to 156.0.8078.47 or later. | ||
| CVE-2026-113046 | FYI | 35 | 7 | 70 | 55 | 8.8 | 24.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113041 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, as described in the October 2026 Stable Channel update. | |||
| CVE-2026-113211 | FYI | 35 | 8 | 70 | 55 | 9.6 | 37.0 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, as shipped in the October 2026 stable channel release. | |||
| CVE-2026-113105 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113108 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113109 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113174 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix. | |||
| CVE-2026-113173 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113172 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix for this issue. | |||
| CVE-2026-113158 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which fixes this issue. | |||
| CVE-2026-113155 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113154 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix for this Canvas memory corruption issue. | |||
| CVE-2026-113153 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, per the Chrome stable channel release. | |||
| CVE-2026-113152 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, as listed in the October 2026 Stable Channel update. | |||
| CVE-2026-113168 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, which fixes this issue. | |||
| CVE-2026-113195 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113197 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113202 | FYI | 35 | 7 | 70 | 55 | 8.8 | 41.6 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which addresses this issue. | |||
| CVE-2026-113203 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.2 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113205 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix. | |||
| CVE-2026-113208 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113230 | FYI | 35 | 7 | 70 | 55 | 8.8 | 38.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later via the Stable Channel update. | |||
| CVE-2026-113231 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113232 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix for this issue. | |||
| CVE-2026-113233 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113044 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113245 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix. | |||
| CVE-2026-113247 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113248 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113251 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.2 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-111815 | REVIEW | 35 | 31 | 13 | 65 | 10.0 | 14.3 | none | none | apache software foundation | apache traffic server | 2026-10-21 | Pre-auth, no-user-interaction flaw in Apache Traffic Server lets a resumed TLS session bypass a host’s verify_client STRICT client-certificate requirement, so mutual-TLS-protected virtual hosts can be reached without a valid client cert. No exploitation has been observed and EPSS is 0.00235. | Upgrade Apache Traffic Server to 9.2.16, 10.1.5, or 10.2.1 (restart required). Until then, avoid relying on verify_client STRICT across SNI virtual hosts on shared listeners, or terminate mTLS on a separate listener. | ||
| CVE-2026-113040 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-111814 | REVIEW | 35 | 31 | 13 | 65 | 10.0 | 14.3 | none | none | apache software foundation | apache traffic server | 2026-10-21 | Pre-authentication, no user interaction, CVSS 10.0, and a fix exists — but exploitation is unconfirmed (SSVC ‘none’, EPSS 0.0024, no public exploit or detection template) and Traffic Server is a niche reverse-proxy/cache deployment. | Upgrade Apache Traffic Server to 9.2.16, 10.1.5, or 10.2.1 (service restart required). If you cannot patch promptly, avoid mixing client-certificate identities on shared outbound sessions or restrict the proxy to trusted backends. | ||
| CVE-2026-113138 | FYI | 35 | 8 | 70 | 55 | 9.6 | 38.3 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix. | |||
| CVE-2026-113190 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.2 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, per the October 2026 Stable Channel release. | |||
| CVE-2026-113328 | FYI | 35 | 8 | 70 | 55 | 9.6 | 41.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113171 | FYI | 35 | 8 | 70 | 55 | 9.6 | 33.2 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113186 | FYI | 35 | 8 | 70 | 55 | 9.6 | 37.0 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, which contains the fix for this DevTools memory corruption issue. | |||
| CVE-2026-113222 | FYI | 35 | 8 | 70 | 55 | 9.6 | 33.2 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix. | |||
| CVE-2026-113342 | FYI | 35 | 8 | 70 | 55 | 9.6 | 41.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix. | |||
| CVE-2026-113134 | FYI | 35 | 7 | 70 | 55 | 8.8 | 35.7 | none | none | google, microsoft | chrome · windows | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Windows to version 156.0.8078.47 or later. | ||
| CVE-2026-113121 | FYI | 35 | 7 | 70 | 55 | 8.8 | 35.2 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113103 | FYI | 35 | 7 | 70 | 55 | 8.8 | 38.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, as listed in the October 2026 Stable Channel update. | |||
| CVE-2026-113106 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later via the Stable Channel update. | |||
| CVE-2026-113169 | FYI | 35 | 8 | 70 | 55 | 9.6 | 33.2 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113206 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, as described in the October 2026 Stable Channel update. | |||
| CVE-2026-113117 | FYI | 35 | 7 | 70 | 55 | 8.8 | 35.7 | none | none | google, apple | chrome · macos | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on macOS to version 156.0.8078.47 or later. | ||
| CVE-2026-113255 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113042 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113018 | FYI | 35 | 7 | 70 | 55 | 8.8 | 37.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix for this IME memory corruption issue. | |||
| CVE-2026-113014 | FYI | 35 | 8 | 70 | 55 | 9.6 | 41.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which fixes this issue. | |||
| CVE-2026-113007 | FYI | 35 | 8 | 70 | 55 | 9.6 | 38.3 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, as listed in the October 2026 Stable Channel update. | |||
| CVE-2026-112992 | FYI | 35 | 8 | 70 | 55 | 9.6 | 38.3 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, as shipped in the October 2026 stable channel update. | |||
| CVE-2026-113052 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, per the October 2026 Stable Channel release. | |||
| CVE-2026-113081 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, which fixes this issue. | |||
| CVE-2026-113163 | FYI | 35 | 7 | 70 | 55 | 8.8 | 44.4 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113156 | FYI | 35 | 7 | 70 | 55 | 8.8 | 39.0 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113085 | FYI | 35 | 7 | 70 | 55 | 8.8 | 24.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113086 | FYI | 35 | 7 | 70 | 55 | 8.8 | 24.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later via the Stable Channel update. | |||
| CVE-2026-113101 | FYI | 35 | 7 | 70 | 55 | 8.8 | 31.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which fixes this issue. | |||
| CVE-2026-113104 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix. | |||
| CVE-2026-113110 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, per the October 2026 stable channel release. | |||
| CVE-2026-113111 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113112 | FYI | 35 | 7 | 70 | 55 | 8.8 | 24.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix for this Extensions use-after-free. | |||
| CVE-2026-113113 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113166 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to version 156.0.8078.47 or later. | |||
| CVE-2026-111813 | REVIEW | 35 | 31 | 13 | 65 | 10.0 | 41.8 | none | none | apache software foundation | apache traffic server | 2026-10-21 | Unauthenticated, no-interaction argument injection into ImageMagick via the magick plugin, but only in its default unsigned configuration and only on hosts running this experimental plugin; no exploitation signal exists yet. | Upgrade Apache Traffic Server to 9.2.16, 10.1.5, or 10.2.1 (restart required). If you cannot patch promptly, disable the experimental magick plugin or restrict access to the proxy to trusted networks. | ||
| CVE-2026-113165 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | google, apple | chrome · macos | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on macOS to 156.0.8078.47 or later. | ||
| CVE-2026-113162 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later via the Stable Channel update. | |||
| CVE-2026-113191 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.2 | none | none | google, apple | chrome · macos | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on macOS to 156.0.8078.47 or later. | ||
| CVE-2026-112392 | FYI | 35 | 21 | 33 | 65 | 8.2 | 20.4 | poc | poc_early | python-pillow | pillow | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | Upgrade to Pillow 13.0.0 or later. | ||
| CVE-2026-113192 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113194 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, as described in the October 2026 Stable Channel update. | |||
| CVE-2026-113213 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113216 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which fixes this issue. | |||
| CVE-2026-113218 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113219 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix for this issue. | |||
| CVE-2026-113266 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113282 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | google, apple | chrome · macos | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on macOS to 156.0.8078.47 or later. | ||
| CVE-2026-113285 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | google, microsoft | chrome · windows | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Windows to 156.0.8078.47 or later. | ||
| CVE-2026-113253 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.2 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113254 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, which contains the fix for this DevTools memory corruption issue. | |||
| CVE-2026-113256 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which fixes this issue. | |||
| CVE-2026-113257 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later via the Stable Channel update. | |||
| CVE-2026-113334 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | google, microsoft | chrome · windows | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Windows to version 156.0.8078.47 or later, as described in the Chrome stable channel release. | ||
| CVE-2026-113323 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | google, apple | chrome · iphone_os | 2026-10-20 | CISA SSVC: total technical impact | Update Chrome for iOS to 156.0.8078.47 or later. | ||
| CVE-2026-113091 | FYI | 35 | 7 | 70 | 55 | 8.8 | 38.2 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later, as listed in the Chrome stable channel release. | |||
| CVE-2026-113096 | FYI | 35 | 7 | 70 | 55 | 8.8 | 38.2 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113119 | FYI | 35 | 7 | 70 | 55 | 8.8 | 35.7 | none | none | google, microsoft | chrome · windows | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Windows to version 156.0.8078.47 or later. | ||
| CVE-2026-113261 | FYI | 35 | 8 | 70 | 55 | 9.6 | 41.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113217 | FYI | 35 | 7 | 70 | 55 | 8.8 | 40.2 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113270 | FYI | 35 | 8 | 70 | 55 | 9.6 | 41.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later; versions prior to 156.0.8078.47 are affected. | |||
| CVE-2026-113183 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix for this issue. | |||
| CVE-2026-113210 | FYI | 35 | 7 | 70 | 55 | 8.8 | 38.3 | none | none | google, microsoft | chrome · windows | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Windows to 156.0.8078.47 or later. | ||
| CVE-2026-113283 | FYI | 35 | 8 | 70 | 55 | 9.6 | 37.0 | none | none | google, microsoft | chrome · windows | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Windows to 156.0.8078.47 or later. | ||
| CVE-2026-113300 | FYI | 35 | 8 | 70 | 55 | 9.6 | 41.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-109444 | FYI | 35 | 43 | 5 | 50 | 9.8 | 38.4 | poc | poc_early | tracer-cloud | opensre | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-113229 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, per the October 2026 stable channel release. | |||
| CVE-2026-113179 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, which contains the fix for this issue. | |||
| CVE-2026-113088 | FYI | 35 | 7 | 70 | 55 | 8.8 | 39.0 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to version 156.0.8078.47 or later. | |||
| CVE-2026-113107 | FYI | 35 | 7 | 70 | 55 | 8.8 | 39.0 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113116 | FYI | 35 | 8 | 70 | 55 | 9.6 | 38.3 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113089 | FYI | 35 | 8 | 70 | 55 | 9.6 | 37.0 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later, as listed in the October 2026 Stable Channel Update for Desktop. | |||
| CVE-2026-113084 | FYI | 35 | 8 | 70 | 55 | 9.6 | 33.2 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113072 | FYI | 35 | 8 | 70 | 55 | 9.6 | 40.9 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113056 | FYI | 35 | 8 | 70 | 55 | 9.6 | 33.2 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, which contains the fix for this issue. | |||
| CVE-2026-113023 | FYI | 35 | 8 | 70 | 55 | 9.6 | 41.5 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later via the Stable Channel update. | |||
| CVE-2026-113019 | FYI | 35 | 7 | 70 | 55 | 8.8 | 37.4 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113161 | FYI | 35 | 7 | 70 | 55 | 8.8 | 41.6 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113177 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.2 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113164 | FYI | 35 | 7 | 70 | 55 | 8.8 | 35.7 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to 156.0.8078.47 or later. | |||
| CVE-2026-113215 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113214 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later. | |||
| CVE-2026-113204 | FYI | 35 | 7 | 70 | 55 | 8.8 | 38.4 | none | none | chrome · android | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome on Android to version 156.0.8078.47 or later. | |||
| CVE-2026-113200 | FYI | 35 | 7 | 70 | 55 | 8.8 | 28.2 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.47 or later. | |||
| CVE-2026-113198 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later; versions prior to 156.0.8078.47 are affected. | |||
| CVE-2026-113189 | FYI | 35 | 8 | 70 | 55 | 9.6 | 37.0 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, as described in the October 2026 Stable Channel update. | |||
| CVE-2026-113268 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | google, apple | chrome · iphone_os | 2026-10-20 | CISA SSVC: total technical impact | Update Chrome on iOS to 156.0.8078.47 or later. | ||
| CVE-2026-113160 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.1 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.47 or later, as shipped in the October 2026 stable channel release. | |||
| CVE-2026-114087 | FYI | 34 | 27 | 18 | 65 | 8.1 | 27.0 | poc | poc_early | triggerdotdev | trigger.dev | 2026-10-21 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | Upgrade to trigger.dev 4.5.6 or later, and replace the default secrets from hosting/docker/.env.example with unique values. | ||
| CVE-2026-113304 | FYI | 34 | 0 | 70 | 65 | 6.5 | 17.4 | none | none | chrome · android | 2026-10-20 | no exploitation evidence in any monitored source | Update Google Chrome on Android to version 156.0.8078.47 or later. | |||
| CVE-2026-91651 | FYI | 34 | 6 | 70 | 55 | 8.5 | 23.5 | none | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | CISA SSVC: total technical impact | Apply the Essbase security patches in Oracle’s October 2026 Critical Patch Update; see the CPU advisory and its Patch Availability Document for the fixed version. | ||
| CVE-2026-91635 | FYI | 34 | 5 | 70 | 55 | 8.1 | 26.8 | none | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | CISA SSVC: total technical impact | Apply the Essbase security patches in Oracle’s October 2026 Critical Patch Update; see the CPU patch availability documentation for the fixed version. | ||
| CVE-2026-82166 | FYI | 34 | 12 | 70 | 40 | 8.8 | none | none | dell | application store | 2026-10-19 | CISA SSVC: total technical impact | Update Dell Application Store to version 26.05.0.7 or later, per Dell advisory DSA-2026-411. | |||
| CVE-2026-113329 | FYI | 34 | 0 | 70 | 65 | 6.5 | 19.5 | none | none | google, apple | chrome · macos | 2026-10-20 | no exploitation evidence in any monitored source | Update Google Chrome on macOS to 156.0.8078.47 or later. | ||
| CVE-2026-112403 | REVIEW | 34 | 19 | 33 | 65 | 9.2 | 23.9 | poc | poc_early | python-pillow | pillow | 2026-10-19 | Heap overflow in Pillow’s JPEG decoder reachable without authentication when an application calls draft() or thumbnail() on attacker-supplied images, but it requires libjpeg-turbo 3.x and a crafted SOF3 file, and EPSS sits at 0.003 with no public exploit code. | Upgrade Pillow to 13.0.0 or later and restart the services that import it. Where you cannot upgrade promptly, avoid passing untrusted JPEGs to draft() or thumbnail(), or validate and re-encode uploads before decoding. | ||
| CVE-2026-91647 | FYI | 34 | 5 | 70 | 55 | 8.1 | 25.8 | none | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | CISA SSVC: total technical impact | Apply the Oracle Critical Patch Update (October 2026) patches for Oracle Essbase; see the CPU advisory and its Patch Availability Document for the fixed version. | ||
| CVE-2026-76291 | FYI | 34 | 7 | 70 | 50 | 8.8 | 35.1 | none | none | splunk | splunk enterprise | 2026-10-21 | CISA SSVC: total technical impact | Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16 or higher. | ||
| CVE-2026-111756 | FYI | 34 | 19 | 33 | 65 | 8.2 | 40.5 | poc | poc_early | follow-redirects | follow-redirects | 2026-10-20 | CISA SSVC: public proof of concept | Upgrade follow-redirects to version 1.16.1 or later, which fixes the header-stripping routine for array-form headers. | ||
| CVE-2026-114607 | REVIEW | 34 | 29 | 13 | 65 | 9.1 | 36.0 | none | none | better-auth | better-auth | 2026-10-22 | Unauthenticated account takeover, but only for deployments combining Magic Link with plain/hashed token storage, a social or Generic OAuth provider, and database state storage. No exploitation observed and EPSS is 0.0042. | Upgrade better-auth to 1.7.7 or later (affected: 1.4.0-beta.18 through 1.7.6). If you cannot upgrade promptly, disable Magic Link or switch account.storeStateStrategy away from database until patched. | ||
| CVE-2026-76298 | FYI | 34 | 7 | 70 | 50 | 8.8 | 28.7 | none | none | splunk | splunk enterprise | 2026-10-21 | CISA SSVC: total technical impact | Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16 or higher; if upgrade is not immediate, disable the PostgreSQL sidecar via [postgres] disabled = true in server.conf and restart. | ||
| CVE-2026-100134 | FYI | 34 | 12 | 70 | 40 | 8.8 | none | none | adobe | acrobat for edge | 2026-10-20 | CISA SSVC: total technical impact | Update Acrobat for Edge to version 154.0.4258.48 or later; versions up to and including 154.0.4258.37 are affected. | |||
| CVE-2026-76490 | FYI | 33 | 10 | 70 | 40 | 8.6 | 26.9 | none | none | cisco | cisco telepresence video communication server (vcs) expressway | 2026-10-21 | CISA SSVC: automatable | Cisco hardening releases for the Expressway Series address these vulnerabilities; see Cisco advisory cisco-sa-exwy-hardening-FhcqBVcs for the fixed software versions. | ||
| CVE-2026-112408 | FYI | 33 | 12 | 38 | 70 | 8.1 | 53.3 | none | aws | amazon sagemaker python sdk | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2) or later. | |||
| CVE-2026-109431 | FYI | 33 | 27 | 13 | 65 | 8.1 | poc | poc_early | camunda | camunda 7 | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | Upgrade to Camunda 7.24.14 or later (7.24.x) or 7.23.17 or later (7.23.x). | |||
| CVE-2026-94482 | FYI | 33 | 12 | 41 | 65 | 8.2 | none | vercel | next.js | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to Next.js 15.5.28 or 16.4.1 or later; versions from 13.0.0 before 15.5.28 and 16.x before 16.4.1 are affected. | ||||
| CVE-2026-116207 | REVIEW | 33 | 26 | 13 | 65 | 9.1 | none | none | yeswiki | yeswiki | 2026-10-25 | Unauthenticated SQL injection reachable over the internet with no user interaction, letting an attacker read user password hashes or exhaust database threads. No exploitation has been observed and no public exploit code is recorded. | Upgrade YesWiki to 4.7.0 or later, or 5.0.0-alpha4 or later on the 5.0 alpha line. If you cannot upgrade promptly, restrict the public Bazar search API to trusted networks and monitor database logs for injected backticks or SLEEP() calls. | |||
| CVE-2026-113678 | FYI | 33 | 26 | 13 | 65 | 9.9 | 50.0 | poc | poc_early | froxlor | froxlor | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | Upgrade to Froxlor 2.3.15 or later, which fixes the symlink-following chown in Statistics::makeChownWithNewStats. | ||
| CVE-2026-94267 | REVIEW | 33 | 17 | 33 | 65 | 9.0 | 33.3 | none | none | unknown | advanced custom fields: extended pro | 2026-10-23 | Unauthenticated visitors can overwrite arbitrary posts, including the plugin’s own field definitions, leading to code execution on the server – but only where a site publishes a form whose post-update action maps target and content to visitor input. | Update Advanced Custom Fields: Extended and Extended PRO to 0.9.2.8 or later. Until then, remove or restrict front-end forms whose post-update action maps target and content to visitor-submitted values, and audit posts for unexpected changes. | ||
| CVE-2026-112712 | FYI | 32 | 10 | 41 | 65 | 9.1 | 23.1 | none | @fastify/middie | @fastify/middie | 2026-10-20 | no exploitation evidence in any monitored source | Upgrade @fastify/middie to 9.3.6 or later; alternatively enforce authorization in a Fastify hook such as preHandler that runs after the router resolves the request. | |||
| CVE-2026-113078 | FYI | 32 | 8 | 70 | 40 | 9.6 | 33.2 | none | none | chrome | 2026-10-20 | CISA SSVC: total technical impact | Upgrade Google Chrome to 156.0.8078.47 or later; versions prior to 156.0.8078.47 are affected. | |||
| CVE-2026-78165 | FYI | 32 | 24 | 13 | 65 | 8.8 | 54.8 | poc | poc_early | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | Upgrade to Apache Camel 4.23.0; on the 4.22.x stream upgrade to 4.22.1 and on the 4.18.x stream to 4.18.5. The 4.14.x stream and earlier are end of life and will not be fixed. | ||
| CVE-2026-110956 | REVIEW | 32 | 31 | 0 | 65 | 9.8 | 29.6 | none | none | unknown | asvereinbase | 2026-10-24 | Authentication bypass in a WordPress plugin: an empty stored password value is treated as a match, so an unauthenticated attacker can log in as any user including an administrator. No exploitation has been observed and EPSS is 0.0036, but the plugin is rare and internet-facing. | Update the asVereinbase WordPress plugin to version 1.1.8 or later, then restart the service. If you cannot patch immediately, deactivate the plugin or restrict wp-login access to trusted networks and review admin accounts for unexpected logins. | ||
| CVE-2026-76505 | FYI | 32 | 18 | 66 | 25 | 7.5 | 26.5 | none | none | cisco | cisco ios xr software | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-92997 | FYI | 32 | 25 | 13 | 65 | 8.6 | none | none | unknown | click n chat (chat widget integration) | 2026-10-21 | CISA SSVC: automatable | Update the Click n Chat (Chat Widget Integration) plugin to version 1.1.3 or later. | |||
| CVE-2026-112896 | FYI | 32 | 15 | 33 | 65 | 8.8 | 20.4 | poc | poc_early | python-pillow | pillow | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | Upgrade Pillow to version 13.0.0 or later. | ||
| CVE-2026-110523 | FYI | 32 | 20 | 21 | 65 | 8.1 | none | none | unknown | wp user manager | 2026-10-21 | CISA SSVC: total technical impact | Upgrade WP User Manager to version 2.9.26 or later. | |||
| CVE-2026-92998 | FYI | 32 | 25 | 13 | 65 | 8.6 | none | none | unknown | click n chat (chat widget integration) | 2026-10-21 | CISA SSVC: automatable | Update the Click n Chat (Chat Widget Integration) plugin to version 1.1.3 or later. | |||
| CVE-2026-76302 | FYI | 32 | 9 | 70 | 40 | 9.9 | 8.1 | none | none | splunk | splunk enterprise | 2026-10-21 | CISA SSVC: total technical impact | Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16 or higher. | ||
| CVE-2026-114635 | FYI | 32 | 10 | 41 | 65 | 8.7 | 9.1 | none | traefik | traefik | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to Traefik 2.11.58 or later, or 3.7.14 or later. | |||
| CVE-2026-76475 | FYI | 32 | 8 | 70 | 40 | 9.3 | 15.5 | none | none | cisco | cisco emergency responder · cisco unified communications manager im and presence service · cisco unity connection | 2026-10-21 | CISA SSVC: total technical impact | Cisco hardening releases address these vulnerabilities; see Cisco advisory cisco-sa-voice-hardening-twgbH9e3 for the fixed release for each affected product. | ||
| CVE-2026-77934 | FYI | 32 | 24 | 13 | 65 | 8.8 | 44.8 | poc | poc_early | coze-dev | coze-studio | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | Upgrade Coze Studio to 0.5.0 or later; a patch commit is referenced for the fix. | ||
| CVE-2026-76299 | FYI | 32 | 9 | 70 | 40 | 9.9 | 3.1 | none | none | splunk | splunk enterprise | 2026-10-21 | CISA SSVC: total technical impact | Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16 or higher. | ||
| CVE-2026-91645 | NOISE | 31 | 0 | 70 | 55 | 5.3 | 26.9 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96385 | NOISE | 31 | 7 | 70 | 40 | 6.5 | 7.4 | none | none | drupal | rest & json api authentication for drupal | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-84917 | NOISE | 31 | 7 | 70 | 40 | 6.5 | 3.2 | none | none | drupal | jsonapi role access | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-112866 | REVIEW | 31 | 22 | 13 | 65 | 9.3 | 29.0 | none | none | wpfactory | product filter by wbw | 2026-10-24 | Unauthenticated blind SQL injection in a WordPress plugin reachable over the internet, with a fixed version already published. No exploitation has been observed and EPSS is low, so this is a patch-on-schedule item rather than an emergency. | Update the Product Filter by WBW plugin to 3.4.7 or later; the fix is a version upgrade and the service restarts. If you cannot patch promptly, put the site behind a WAF or restrict access to the affected filter endpoints. | ||
| CVE-2026-101809 | NOISE | 31 | 31 | 13 | 49 | 10.0 | 45.0 | none | none | oracle corporation | workflow | 2026-10-20 | Unauthenticated network attacker can take over Oracle E-Business Suite Workflow (12.2.3-12.2.15) with no user interaction, CVSS 10.0. No exploitation is confirmed: EPSS is 0.005 and no KEV, Metasploit, ExploitDB or nuclei signal exists. | No fix is stated in the evidence. Restrict HTTP access to the Workflow Notification Mailer to trusted networks or place it behind a WAF/VPN, and monitor the Oracle advisory for a patch covering 12.2.3-12.2.15. | ||
| CVE-2026-114139 | NOISE | 31 | 10 | 33 | 70 | 9.1 | 33.8 | none | getsentry | sentry-javascript | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade @sentry/nextjs to 9.47.2, 10.75.2, or 11.0.0-rc.1 or later. | |||
| CVE-2026-91646 | NOISE | 31 | 0 | 70 | 55 | 5.6 | 17.1 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113506 | NOISE | 31 | 31 | 13 | 50 | 9.9 | poc | poc_early | n/a | aapanel | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | ||||
| CVE-2026-84920 | NOISE | 31 | 7 | 70 | 40 | 5.3 | 3.2 | none | none | drupal | unpublished node permissions | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-111764 | NOISE | 31 | 25 | 25 | 50 | 7.5 | poc | poc_early | a2aproject | a2a-java | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-91654 | NOISE | 31 | 0 | 70 | 55 | 6.3 | 7.8 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91660 | NOISE | 31 | 0 | 70 | 55 | 4.3 | 22.4 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76478 | NOISE | 31 | 7 | 70 | 40 | 8.8 | 1.4 | none | none | cisco | cisco emergency responder · cisco unified communications manager im and presence service · cisco unity connection | 2026-10-21 | CISA SSVC: total technical impact | Apply the software hardening releases described in Cisco advisory cisco-sa-voice-hardening-twgbH9e3 for the affected voice products. | ||
| CVE-2026-111064 | NOISE | 31 | 12 | 33 | 65 | 8.2 | none | aio-libs | aiohttp | 2026-10-19 | no exploitation evidence in any monitored source | Upgrade aiohttp to version 3.14.4 or later. | ||||
| CVE-2026-113199 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 13.3 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91632 | NOISE | 31 | 0 | 70 | 55 | 7.7 | 23.0 | none | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-79857 | NOISE | 31 | 26 | 33 | 40 | 9.8 | 72.6 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-113157 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 27.3 | none | none | google, microsoft | chrome · windows | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91633 | NOISE | 31 | 0 | 70 | 55 | 6.0 | 3.8 | none | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-112778 | NOISE | 31 | 0 | 38 | 85 | 8.8 | 10.3 | none | none | traefik | traefik 3.7.0 | 2026-10-19 | no exploitation evidence in any monitored source | Upgrade to Traefik 2.11.46 or later, 3.6.17 or later, or 3.7.1 or later. | ||
| CVE-2026-114655 | NOISE | 31 | 0 | 75 | 50 | 5.9 | 18.7 | none | mongodb | libmongocrypt | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87937 | NOISE | 31 | 7 | 70 | 40 | 6.5 | 7.3 | none | none | drupal | central authentication system (cas) server | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-84914 | NOISE | 31 | 7 | 70 | 40 | 5.3 | 3.2 | none | none | drupal | calculate working days | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-111816 | REVIEW | 31 | 22 | 13 | 65 | 9.3 | 23.4 | none | none | apache software foundation | apache traffic server | 2026-10-21 | Pre-auth, no-interaction cache poisoning and response-framing desync in Apache Traffic Server; a fix is published, but there is no sign of exploitation yet (EPSS 0.003, no KEV, no public exploit code). | Upgrade Apache Traffic Server to 9.2.16, 10.1.5, or 10.2.1 and restart the service. If you cannot patch promptly, restrict cache-facing listeners to trusted upstreams and monitor for anomalous cached responses. | ||
| CVE-2026-112145 | NOISE | 31 | 25 | 33 | 40 | 7.3 | poc | poc_early | speaches-ai | speaches | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-111759 | NOISE | 31 | 25 | 25 | 50 | 7.5 | poc | poc_early | markdown-it | markdown-it | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-91639 | NOISE | 31 | 0 | 70 | 55 | 7.7 | 33.1 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76487 | NOISE | 31 | 7 | 70 | 40 | 5.3 | 42.0 | none | none | cisco | cisco unified communications manager | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-91657 | NOISE | 31 | 0 | 70 | 55 | 4.3 | 8.9 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91659 | NOISE | 31 | 0 | 70 | 55 | 7.7 | 15.7 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91650 | NOISE | 31 | 0 | 70 | 55 | 3.7 | 19.7 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91652 | NOISE | 31 | 0 | 70 | 55 | 5.0 | 16.1 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113295 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 21.7 | none | none | google, microsoft | chrome · windows | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113325 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 19.5 | none | none | google, apple | chrome · iphone_os | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113151 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 17.4 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112296 | NOISE | 31 | 36 | 0 | 50 | 9.8 | none | none | sunkaifei | flycms | 2026-10-19 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-87950 | NOISE | 31 | 7 | 70 | 40 | 5.3 | 3.2 | none | none | drupal | saml sso – service provider | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-113054 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 17.4 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113389 | NOISE | 31 | 31 | 13 | 50 | 9.9 | poc | poc_early | draytek | vigor2960 | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | ||||
| CVE-2026-113047 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 17.4 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113050 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 11.7 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96380 | NOISE | 31 | 7 | 70 | 40 | 6.5 | 2.5 | none | none | drupal | css usage analyzer | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-113051 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 11.7 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76477 | NOISE | 31 | 7 | 70 | 40 | 8.8 | 29.1 | none | none | cisco | cisco emergency responder · cisco unified communications manager im and presence service · cisco unity connection | 2026-10-21 | CISA SSVC: total technical impact | Cisco has published hardening releases addressing these SQL injection issues; see Cisco Security Advisory cisco-sa-voice-hardening-twgbH9e3 for the fixed versions per product. | ||
| CVE-2026-113178 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 13.3 | none | none | google, apple | chrome · macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-76476 | NOISE | 31 | 7 | 70 | 40 | 8.8 | 25.9 | none | none | cisco | cisco emergency responder · cisco unified communications manager im and presence service · cisco unity connection | 2026-10-21 | CISA SSVC: total technical impact | Cisco hardening releases address these flaws; see Cisco advisory cisco-sa-voice-hardening-twgbH9e3 for the fixed versions per product. | ||
| CVE-2026-91649 | NOISE | 31 | 0 | 70 | 55 | 6.0 | 7.8 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91648 | NOISE | 31 | 0 | 70 | 55 | 5.3 | 26.9 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113159 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 20.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113193 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 13.3 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113201 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 13.3 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113223 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 17.4 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113225 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 17.4 | none | none | chrome · android | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113277 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 17.4 | none | none | chrome · android | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91643 | NOISE | 31 | 0 | 70 | 55 | 5.3 | 17.7 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113341 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 19.8 | none | none | chrome · android | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113326 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 19.5 | none | none | google, microsoft | chrome · windows | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91642 | NOISE | 31 | 0 | 70 | 55 | 7.3 | 16.4 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91641 | NOISE | 31 | 0 | 70 | 55 | 5.0 | 14.2 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91640 | NOISE | 31 | 0 | 70 | 55 | 5.0 | 14.2 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91631 | NOISE | 31 | 0 | 70 | 55 | 5.0 | 22.8 | none | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-96366 | NOISE | 31 | 7 | 70 | 40 | 5.3 | 8.8 | none | none | drupal | webform | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-91634 | NOISE | 31 | 0 | 70 | 55 | 5.3 | 17.7 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91662 | NOISE | 31 | 0 | 70 | 55 | 6.4 | 1.0 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76462 | NOISE | 31 | 3 | 78 | 40 | 5.5 | 3.3 | none | none | cisco | cisco secure client | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-79860 | NOISE | 31 | 16 | 41 | 50 | 9.8 | 54.5 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91636 | NOISE | 31 | 0 | 70 | 55 | 7.7 | 33.1 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113102 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 17.4 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76435 | NOISE | 31 | 7 | 70 | 40 | 5.3 | 26.3 | none | none | cisco | cisco telepresence video communication server (vcs) expressway | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-96356 | NOISE | 31 | 7 | 70 | 40 | 5.3 | 8.8 | none | none | drupal | webform | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-96386 | NOISE | 31 | 7 | 70 | 40 | 6.5 | 7.2 | none | none | drupal | smart content | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-114727 | NOISE | 31 | 5 | 33 | 80 | 8.3 | 25.1 | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to Roundcube Webmail 1.6.20 or later, or 1.7.5 or later, which remove svg and eps from accepted image types. | |||
| CVE-2026-96364 | NOISE | 31 | 7 | 70 | 40 | 5.3 | 3.8 | none | none | drupal | webform | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-53995 | NOISE | 31 | 31 | 13 | 50 | 8.2 | 45.6 | poc | poc_early | mlflow | mlflow | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-87943 | NOISE | 31 | 7 | 70 | 40 | 6.5 | 3.2 | none | none | drupal | saml sso – service provider | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-96377 | NOISE | 31 | 7 | 70 | 40 | 5.3 | 3.0 | none | none | drupal | combined image style | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-113340 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 19.5 | none | none | google, microsoft | chrome · windows | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113246 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 21.7 | none | none | google, apple | chrome · iphone_os | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113237 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 21.7 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111765 | NOISE | 31 | 25 | 25 | 50 | 7.5 | 51.6 | poc | poc_early | a2aproject | a2a-java | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-91491 | NOISE | 31 | 26 | 33 | 40 | 9.8 | none | none | oracle corporation | oracle identity manager connector | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-28328 | NOISE | 31 | 17 | 58 | 30 | 8.8 | none | none | solarwinds | solarwinds observability self-hosted | 2026-10-20 | CISA SSVC: total technical impact | Upgrade to SolarWinds Observability Self-Hosted version 2026.4 or later; versions 2026.2.3 and all previous versions are affected. | |||
| CVE-2026-101763 | NOISE | 31 | 26 | 30 | 40 | 9.8 | none | none | oracle corporation | oracle communications brm – elastic charging engine | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-86949 | NOISE | 31 | 7 | 70 | 40 | 8.8 | 2.7 | none | none | apple | xcode | 2026-10-20 | CISA SSVC: total technical impact | Fixed in Xcode 27, which enforces library validation on the affected binaries. | ||
| CVE-2026-76530 | NOISE | 31 | 7 | 70 | 40 | 8.8 | 2.1 | none | none | splunk | splunk soar | 2026-10-21 | CISA SSVC: total technical impact | Upgrade Splunk SOAR to version 8.7.0 or higher. | ||
| CVE-2026-91630 | NOISE | 31 | 0 | 70 | 55 | 6.8 | 25.2 | none | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91661 | NOISE | 31 | 0 | 70 | 55 | 7.7 | 24.5 | none | oracle, oracle corporation | oracle essbase | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98884 | NOISE | 30 | 0 | 70 | 50 | 8.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98877 | NOISE | 30 | 0 | 70 | 50 | 7.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76495 | NOISE | 30 | 5 | 70 | 40 | 7.8 | 1.0 | none | none | cisco | cisco telepresence video communication server (vcs) expressway | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-98939 | NOISE | 30 | 0 | 70 | 50 | 5.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91490 | NOISE | 30 | 24 | 33 | 40 | 9.1 | none | none | oracle corporation | oracle identity manager connector | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-99007 | NOISE | 30 | 0 | 70 | 50 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99056 | NOISE | 30 | 0 | 78 | 40 | 7.8 | 5.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99047 | NOISE | 30 | 0 | 70 | 50 | 10.6 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98929 | NOISE | 30 | 0 | 70 | 50 | 5.9 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99012 | NOISE | 30 | 0 | 70 | 50 | 7.8 | 5.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107858 | NOISE | 30 | 0 | 70 | 50 | 7.2 | 29.5 | none | agent development kit (adk) for java | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112393 | REVIEW | 30 | 11 | 33 | 65 | 9.2 | 43.6 | poc | poc_early | python-pillow | pillow | 2026-10-19 | Heap overflow in Pillow’s TIFF writer is reachable without authentication when an application saves attacker-influenced TIFF data to an in-memory target; EPSS is low (0.005) and no public exploit code is recorded, so this is a fix-soon rather than drop-everything item. | Upgrade Pillow to 13.0.0 or later (all versions 2.0.0 through 12.x affected) and restart the service. Where upgrade must wait, avoid writing untrusted TIFF data to BytesIO-style targets without a real file descriptor. | ||
| CVE-2026-99015 | NOISE | 30 | 0 | 70 | 50 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98946 | NOISE | 30 | 0 | 70 | 50 | 5.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111057 | REVIEW | 30 | 26 | 1 | 65 | 10.0 | none | mljar | mercury | 2026-10-19 | Unauthenticated, no-interaction path to an interactive OS shell via the /api/terminals blocklist bypass, but Mercury is a niche self-hosted notebook-publishing framework, so exposure is limited to organisations actually running it. | Upgrade Mercury to 3.2.4 or later, which corrects the BLOCKED_PATTERNS regex, then restart the service. If you cannot upgrade promptly, block /api/terminals at the reverse proxy or restrict the instance to trusted networks. | ||||
| CVE-2026-96376 | NOISE | 30 | 3 | 75 | 40 | 6.4 | 47.4 | none | none | drupal | cloud | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-114645 | NOISE | 30 | 0 | 70 | 50 | 5.2 | 5.8 | none | mongodb | c driver | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114650 | NOISE | 30 | 0 | 70 | 50 | 5.9 | 1.2 | none | mongodb | c# driver · mongodb.libmongocrypt nuget package | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98949 | NOISE | 30 | 0 | 78 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113391 | NOISE | 30 | 31 | 13 | 45 | 9.9 | poc | poc_early | draytek | vigor2960 | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | Upgrade Vigor2960 firmware to version 1.5.1.7, which the vendor states corrects this and other security issues. | |||
| CVE-2026-98942 | NOISE | 30 | 0 | 70 | 50 | 5.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76292 | NOISE | 30 | 0 | 78 | 40 | 6.5 | 17.4 | none | none | splunk | splunk enterprise · splunk secure gateway | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-76308 | NOISE | 30 | 0 | 70 | 50 | 6.5 | 6.6 | none | none | splunk | splunk soar | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-89035 | NOISE | 30 | 0 | 78 | 40 | 7.4 | 18.7 | none | mikrotik | routeros | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112158 | NOISE | 30 | 0 | 78 | 40 | 6.5 | none | none | mikrotik | routeros | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-86957 | NOISE | 30 | 0 | 78 | 40 | 6.5 | 4.8 | none | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-76294 | NOISE | 30 | 0 | 70 | 50 | 4.3 | 9.9 | none | none | splunk | splunk enterprise | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-76296 | NOISE | 30 | 0 | 70 | 50 | 4.3 | 9.9 | none | none | splunk | splunk enterprise | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-86961 | NOISE | 30 | 5 | 70 | 40 | 7.8 | 3.1 | none | none | apple | ios and ipados · macos | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-99034 | NOISE | 30 | 0 | 70 | 50 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2022-51022 | NOISE | 30 | 14 | 13 | 80 | 9.1 | none | liukuo362573 | yishaadmin | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to a build containing commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef (or the related patch c3b66e6); versions 2.2 through 3.1 are affected. | ||||
| CVE-2026-99048 | NOISE | 30 | 0 | 70 | 50 | 5.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98928 | NOISE | 30 | 0 | 78 | 40 | 5.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99049 | NOISE | 30 | 0 | 78 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99052 | NOISE | 30 | 0 | 70 | 50 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-96185 | NOISE | 30 | 4 | 70 | 40 | 7.5 | 45.1 | none | none | microsoft | microsoft exchange online | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-112897 | NOISE | 30 | 10 | 33 | 65 | 8.7 | 20.6 | poc | poc_early | python-pillow | pillow | 2026-10-19 | CISA SSVC: public proof of concept | Upgrade Pillow to version 13.0.0 or later; versions from 5.3.0 up to but not including 13.0.0 are affected. | ||
| CVE-2026-112398 | REVIEW | 30 | 11 | 33 | 65 | 9.2 | 23.9 | poc | poc_early | python-pillow | pillow | 2026-10-19 | Heap buffer overflow in Pillow’s FlashPix decoder reachable without authentication when an app opens or thumbnails untrusted images, but exploitation requires the optional olefile dependency and a crafted FPX file, and EPSS is 0.003 with no public exploit code. | Upgrade Pillow to 13.0.0 or later and restart the service. If you cannot upgrade promptly, avoid processing untrusted FlashPix/FPX files and drop the optional olefile dependency where it is not needed. | ||
| CVE-2026-98869 | NOISE | 30 | 0 | 70 | 50 | 7.8 | 5.7 | none | linux | linux | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-77930 | REVIEW | 30 | 25 | 0 | 70 | 9.8 | 37.6 | poc | poc_early | evoscientist | evoscientist | 2026-10-20 | A pre-auth, no-interaction CVSS 9.8 approval bypass in EvoScientist lets prompt-injected content run host shell commands with user privileges and environment secrets, but exploitation is only at proof-of-concept stage and EPSS is 0.0044. | Upgrade EvoScientist to 0.2.5 or later, which contains patch commit d249e32 adding the missing interrupt_on gate for async sub-agents. Until upgraded, avoid ingesting untrusted web content into the agent and run it without access to sensitive environment secrets. | ||
| CVE-2026-76494 | NOISE | 30 | 5 | 70 | 40 | 7.8 | 4.0 | none | none | cisco | cisco telepresence video communication server (vcs) expressway | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-98941 | NOISE | 30 | 0 | 70 | 50 | 7.0 | 3.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114639 | NOISE | 30 | 10 | 33 | 65 | 8.7 | 22.7 | none | traefik | traefik | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to Traefik 2.11.58 or later in the 2.11.x line, or 3.7.14 or later in the 3.x line. | |||
| CVE-2026-114637 | NOISE | 30 | 10 | 33 | 65 | 8.7 | 21.5 | none | traefik | traefik | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to Traefik 3.7.14 or later; versions from 3.2.0 before 3.7.14 are affected. | |||
| CVE-2026-98924 | NOISE | 30 | 0 | 70 | 50 | 8.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98911 | NOISE | 30 | 0 | 78 | 40 | 7.5 | 24.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111761 | NOISE | 30 | 19 | 30 | 50 | 5.8 | 42.8 | poc | poc_early | a2aproject | a2a-java | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-98910 | NOISE | 30 | 0 | 70 | 50 | 6.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76304 | NOISE | 30 | 0 | 70 | 50 | 4.3 | 5.0 | none | none | splunk | splunk soar | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-76295 | NOISE | 30 | 0 | 78 | 40 | 4.3 | 9.4 | none | none | splunk | splunk enterprise · splunk secure gateway | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-93336 | NOISE | 30 | 0 | 70 | 50 | 7.1 | 11.8 | none | canonical | juju | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99039 | NOISE | 30 | 0 | 70 | 50 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98922 | NOISE | 30 | 0 | 70 | 50 | 4.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99026 | NOISE | 30 | 0 | 70 | 50 | 6.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98919 | NOISE | 30 | 0 | 78 | 40 | 6.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-71170 | NOISE | 30 | 5 | 70 | 40 | 7.8 | 5.6 | none | none | dell | application store | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-113866 | NOISE | 30 | 0 | 70 | 50 | 5.9 | 29.1 | none | none | mozilla | thunderbird | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-98888 | NOISE | 30 | 0 | 70 | 50 | 8.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113390 | NOISE | 30 | 31 | 13 | 45 | 9.9 | 81.9 | poc | poc_early | draytek | vigor2960 | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | DrayTek states that Vigor2960 firmware 1.5.1.7 has corrected many security issues; the device is EoS with limited support, so upgrade to 1.5.1.7 or later where available. | ||
| CVE-2026-98904 | NOISE | 30 | 0 | 70 | 50 | 6.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98903 | NOISE | 30 | 0 | 70 | 50 | 6.6 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99073 | NOISE | 30 | 0 | 78 | 40 | 4.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-53921 | NOISE | 30 | 16 | 21 | 65 | 9.8 | 66.0 | none | openwrt | odhcpd | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade odhcpd to version 25.12 or later, which patches the DHCPv6 IA response buffer overflows. | |||
| CVE-2026-93442 | NOISE | 30 | 14 | 50 | 40 | 8.2 | none | none | ibm | qradar | 2026-10-20 | CISA SSVC: automatable | Update to QRadar SIEM 7.6.0.5 (for 7.6.0.x) or 7.5.0 Update Package 16 Interim Fix 002 (for 7.5.0); see IBM advisory node/7292240. | |||
| CVE-2026-76524 | NOISE | 30 | 5 | 70 | 40 | 7.8 | 2.8 | none | none | cisco | cisco open source snort3 | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-99005 | NOISE | 30 | 0 | 70 | 50 | 8.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113672 | NOISE | 30 | 16 | 21 | 65 | 9.9 | none | argoproj | argo-cd | 2026-10-20 | no exploitation evidence in any monitored source | Upgrade to Argo CD 3.3.15, 3.4.10, 3.5.4 or 3.6.0-rc2 or later. | ||||
| CVE-2026-98986 | NOISE | 30 | 0 | 70 | 50 | 6.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99061 | NOISE | 30 | 0 | 70 | 50 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76479 | NOISE | 30 | 5 | 70 | 40 | 7.8 | 8.2 | none | none | cisco | cisco emergency responder · cisco unified communications manager im and presence service · cisco unity connection | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-98954 | NOISE | 30 | 0 | 70 | 50 | 6.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107084 | NOISE | 30 | 29 | 13 | 50 | 8.8 | poc | poc_early | n/a | n/a | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | ||||
| CVE-2026-98945 | NOISE | 30 | 0 | 78 | 40 | 7.8 | 5.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98896 | NOISE | 30 | 0 | 78 | 40 | 8.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98983 | NOISE | 30 | 0 | 78 | 40 | 5.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98967 | NOISE | 30 | 0 | 70 | 50 | 7.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-28853 | NOISE | 30 | 5 | 70 | 40 | 7.8 | 7.9 | none | none | apple | macos | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-98957 | NOISE | 30 | 0 | 70 | 50 | 7.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114509 | NOISE | 30 | 10 | 33 | 65 | 9.2 | 33.4 | none | laravel | framework | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to Laravel 12.68.0 or later, or 13.29.0 or later. | |||
| CVE-2026-113470 | NOISE | 30 | 0 | 70 | 50 | 5.4 | none | none | mozilla | firefox · thunderbird | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113867 | NOISE | 30 | 0 | 70 | 50 | 7.1 | none | mozilla | thunderbird | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-90910 | REVIEW | 29 | 26 | 25 | 40 | 9.8 | none | none | apache software foundation | apache answer | 2026-10-19 | Pre-auth, no-interaction flaw in Apache Answer’s reaction API lets unauthenticated users read reaction metadata from restricted content and manipulate their own reactions; CVSS 9.8, but no exploitation signal (no KEV, no EPSS, no exploit code) and the product is niche. | Upgrade Apache Answer to 2.0.3 or later; all versions through 2.0.2 are affected. If you cannot upgrade promptly, restrict the instance to trusted networks or place it behind authentication at the proxy, since the reaction API itself enforces none. | |||
| CVE-2026-71169 | NOISE | 29 | 3 | 70 | 40 | 7.0 | 1.4 | none | none | dell | application store | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-43848 | NOISE | 29 | 7 | 50 | 50 | 6.9 | 18.6 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-101537 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle solaris | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-113358 | NOISE | 29 | 25 | 25 | 40 | 7.5 | poc | poc_early | lavalite | cms | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-113711 | NOISE | 29 | 25 | 25 | 40 | 7.5 | poc | poc_early | apostrophecms, @apostrophecms | apostrophe · import-export | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-91214 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle soa suite | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-113620 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | eclipse foundation | eclipse iofog | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-112301 | NOISE | 29 | 25 | 25 | 40 | 7.3 | 80.8 | poc | poc_early | orbitale | imagemagick-php | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-84579 | NOISE | 29 | 3 | 70 | 40 | 7.3 | none | none | apple | macos | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-77935 | NOISE | 29 | 23 | 18 | 50 | 8.3 | 25.7 | poc | poc_early | coze-dev | coze-studio | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-83399 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle weblogic server | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-116060 | NOISE | 29 | 25 | 25 | 40 | 7.3 | poc | poc_early | sourcecodester | performance indicator system | 2026-10-25 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-79856 | NOISE | 29 | 21 | 25 | 50 | 9.8 | 48.9 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-79855 | NOISE | 29 | 26 | 25 | 40 | 9.8 | 54.8 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-79854 | NOISE | 29 | 26 | 25 | 40 | 9.8 | 50.4 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-12660 | NOISE | 29 | 0 | 60 | 55 | 2.7 | 14.9 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-12669 | NOISE | 29 | 0 | 60 | 55 | 4.3 | 4.8 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2014-125133 | NOISE | 29 | 25 | 25 | 40 | 7.5 | 66.0 | poc | poc_early | imithemes | nativechurch | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-76307 | NOISE | 29 | 3 | 70 | 40 | 7.2 | 33.7 | none | none | splunk | splunk soar | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-76303 | NOISE | 29 | 3 | 70 | 40 | 5.7 | 13.6 | none | none | splunk | splunk soar | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-102785 | NOISE | 29 | 26 | 25 | 40 | 10.0 | none | none | yootheme.com | yootheme pro extension for joomla | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-79859 | NOISE | 29 | 16 | 33 | 49 | 9.8 | 52.6 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79853 | NOISE | 29 | 16 | 33 | 50 | 9.8 | 52.8 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-78846 | NOISE | 29 | 26 | 13 | 49 | 9.8 | none | none | n/a | n/a | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-83397 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle data integrator | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-87251 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle access manager | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-111862 | REVIEW | 29 | 26 | 25 | 40 | 9.8 | 52.9 | none | none | rankmath | rank math seo pro | 2026-10-19 | This is a supply-chain compromise, not a code flaw: a subset of Rank Math SEO PRO 3.0.123 packages shipped with malware that can create hidden backdoors, rogue admin accounts and exfiltrate WordPress and database credentials. Sites that activated an affected package are already compromised. | Upgrade to Rank Math SEO PRO 3.0.124. If any site activated a 3.0.123 package obtained between 2026-10-15 20:02 and 2026-10-16 07:12 UTC, treat it as compromised: hunt the vendor’s listed indicators (malicious wp_options keys, hidden PHP backdoors, rogue admins, fake core file, .cache files, cron marker), block rank1cdn[.]com, and rotate WordPress, database and API credentials. | ||
| CVE-2026-112371 | NOISE | 29 | 26 | 13 | 50 | 9.9 | 36.6 | poc | poc_early | h3c | magic nx15 | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-91220 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle business process management suite | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-96375 | NOISE | 29 | 0 | 75 | 40 | 4.8 | 0.4 | none | none | drupal | cloud | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-76587 | NOISE | 29 | 12 | 50 | 40 | 8.8 | 51.4 | none | none | ibm | planning analytics | 2026-10-20 | CISA SSVC: total technical impact | Upgrade IBM Planning Analytics Local to 2.1.24 or later, available from Fix Central; IBM Planning Analytics Cloud environments have already been remediated. | ||
| CVE-2026-25784 | NOISE | 29 | 11 | 13 | 80 | 9.8 | 27.8 | none | hallo welt! gmbh | bluespice | 2026-10-23 | no exploitation evidence in any monitored source | Update to BlueSpice 5.2.7 or later; 5.2.7 container images pulled before 2026-10-19 15:37 UTC must be re-pulled and containers re-created. | |||
| CVE-2026-112149 | NOISE | 29 | 25 | 25 | 40 | 7.3 | poc | poc_early | vraj404 | criminal-management-system | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-43838 | REVIEW | 29 | 17 | 38 | 45 | 9.2 | 22.9 | none | none | advantech | adam-3600 | 2026-10-20 | Pre-authentication stack buffer overflow in the ADAM-3600 login path that can yield code execution, but the device is niche OT kit, EPSS is 0.003 and no exploitation, exploit code or detection template has been observed. | Update ADAM-3600 to 2.8.5.0 or later; versions prior to 2.8.5.0 are affected. Schedule the downtime this requires, and until then keep the device off the public internet and behind a firewall or VPN with access limited to trusted hosts. | ||
| CVE-2026-11831 | NOISE | 29 | 0 | 60 | 55 | 5.4 | 9.9 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-83396 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle data integrator | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-91408 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle identity manager | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-12155 | NOISE | 29 | 0 | 60 | 55 | 6.5 | 17.4 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-112152 | NOISE | 29 | 25 | 25 | 40 | 7.3 | poc | poc_early | vraj404 | criminal-management-system | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-112142 | NOISE | 29 | 25 | 25 | 40 | 7.3 | poc | poc_early | satya-vinay | events-management-system | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-79852 | NOISE | 29 | 26 | 25 | 40 | 9.8 | 50.4 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-57116 | NOISE | 29 | 11 | 13 | 80 | 9.8 | 19.5 | none | mervinpraison | praisonai | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade PraisonAI to version 4.6.59 or later, which patches the unauthenticated AgentOS chat route. | |||
| CVE-2026-112143 | NOISE | 29 | 25 | 25 | 40 | 7.3 | poc | poc_early | satya-vinay | events-management-system | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-12665 | REVIEW | 29 | 19 | 48 | 30 | 9.8 | 24.2 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | Pre-authentication stack overflow reachable over the network during TLS channel establishment, with a CVSS of 9.8 and a fix already shipped. No exploitation signal exists yet, so this is a patch-now item rather than an incident. | Upgrade IBM MQ Operator to v4.1.0 or later and rebuild supplied MQ Advanced container images from the fixed release. Until the upgrade completes, restrict MQ channel listeners to trusted networks and watch for malformed TLS client certificates on exposed channels. | ||
| CVE-2026-112139 | NOISE | 29 | 25 | 25 | 40 | 7.3 | poc | poc_early | subhajitkhan | online-clinic-management-system | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-12350 | NOISE | 29 | 0 | 60 | 55 | 6.5 | 17.4 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-12343 | NOISE | 29 | 0 | 60 | 55 | 6.5 | 14.9 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-91495 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle webcenter content | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-79861 | NOISE | 29 | 16 | 33 | 50 | 9.8 | 75.0 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79844 | NOISE | 29 | 26 | 25 | 40 | 10.0 | 52.5 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-79846 | NOISE | 29 | 26 | 25 | 40 | 10.0 | 71.7 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-79850 | NOISE | 29 | 26 | 25 | 40 | 10.0 | 52.5 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-112141 | NOISE | 29 | 25 | 25 | 40 | 7.3 | poc | poc_early | satya-vinay | events-management-system | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-112150 | NOISE | 29 | 25 | 25 | 40 | 7.3 | poc | poc_early | vraj404 | criminal-management-system | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-112151 | NOISE | 29 | 25 | 25 | 40 | 7.3 | poc | poc_early | vraj404 | criminal management system | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-91234 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle soa suite | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-101499 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle webcenter sites | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-91323 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle weblogic server | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-12664 | NOISE | 29 | 3 | 70 | 40 | 6.8 | 25.9 | none | none | gitlab | gitlab | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-79851 | NOISE | 29 | 26 | 25 | 40 | 10.0 | 55.0 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-60432 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle solaris | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-12727 | NOISE | 29 | 0 | 60 | 55 | 4.3 | 12.5 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-86948 | NOISE | 29 | 3 | 70 | 40 | 2.7 | none | none | apple | xcode | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2014-125134 | NOISE | 29 | 25 | 25 | 40 | 7.5 | 56.9 | poc | poc_early | churchope | churchope | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-76496 | NOISE | 29 | 3 | 70 | 40 | 7.0 | 1.8 | none | none | cisco | cisco telepresence video communication server (vcs) expressway | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-6719 | NOISE | 29 | 13 | 50 | 40 | 7.5 | none | none | ibm | concert | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-111058 | REVIEW | 29 | 26 | 25 | 40 | 9.8 | none | none | mljar | mercury | 2026-10-19 | Pre-authentication, no-user-interaction remote code execution (CVSS 9.8) in default tokenless Mercury deployments: anonymous clients can create kernels and execute arbitrary Python. No exploitation has been observed and no public exploit code is known. | Upgrade to Mercury 3.2.6 or later, which fixes the missing authorization on /api/kernels, then restart the service. If you cannot upgrade promptly, restrict access to trusted networks or place the instance behind a VPN or authenticating proxy. | |||
| CVE-2026-101767 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle application object library | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-91233 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle soa suite | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-76531 | NOISE | 29 | 14 | 58 | 30 | 9.9 | 8.1 | none | none | splunk | splunk soar | 2026-10-21 | CISA SSVC: total technical impact | Upgrade Splunk SOAR to version 8.7.0 or higher. | ||
| CVE-2026-114089 | NOISE | 29 | 24 | 1 | 65 | 8.8 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to trigger.dev 4.5.2 or later, which is the first unaffected version. | ||||
| CVE-2026-43845 | REVIEW | 29 | 17 | 38 | 45 | 9.2 | 25.9 | none | none | advantech | adam-3600 | 2026-10-20 | Pre-authentication password-reset bypass on an internet-exposed Advantech ADAM-3600 controller, CVSS 9.2 with no user interaction. No exploitation is confirmed and EPSS is low (0.00339), so this is a patch-before-someone-looks item rather than an active incident. | Update ADAM-3600 to version 2.8.5.0 or later; all versions prior to 2.8.5.0 are affected. Plan the downtime, and until then keep the device off the public internet – restrict management access to trusted networks or a VPN. | ||
| CVE-2026-11829 | NOISE | 29 | 0 | 60 | 55 | 6.5 | 14.9 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-91235 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle soa suite | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-79848 | NOISE | 29 | 26 | 25 | 40 | 10.0 | 53.0 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-79849 | NOISE | 29 | 26 | 25 | 40 | 10.0 | 53.0 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-112370 | NOISE | 29 | 26 | 13 | 50 | 9.9 | 76.8 | poc | poc_early | h3c | magic nx15 | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-11828 | NOISE | 29 | 0 | 60 | 55 | 5.9 | 16.7 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-112153 | NOISE | 29 | 25 | 25 | 40 | 7.3 | poc | poc_early | vraj404 | criminal-management-system | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-93744 | NOISE | 29 | 12 | 50 | 40 | 6.5 | none | none | ibm | i | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-79847 | NOISE | 29 | 26 | 25 | 40 | 10.0 | 56.9 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-12670 | NOISE | 29 | 0 | 60 | 55 | 6.5 | 11.3 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-91236 | NOISE | 29 | 26 | 25 | 40 | 9.8 | none | none | oracle corporation | oracle soa suite | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-96373 | NOISE | 28 | 0 | 70 | 40 | 3.3 | 7.0 | none | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-86940 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 2.7 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-96390 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 2.5 | none | none | drupal | editoria11y accessibility checker | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96388 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 0.7 | none | none | drupal | tawk.to – live chat application | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96358 | NOISE | 28 | 0 | 70 | 40 | 4.6 | 9.9 | none | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-87952 | NOISE | 28 | 0 | 70 | 40 | 3.1 | 8.5 | none | none | drupal | saml sso – service provider | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96392 | NOISE | 28 | 0 | 70 | 40 | 3.5 | 5.4 | none | none | drupal | ai ckeditor | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96378 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 34.9 | none | none | drupal | commerce decoupled checkout | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96372 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 8.8 | none | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-87938 | NOISE | 28 | 0 | 70 | 40 | 5.8 | none | drupal | csp log | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86977 | NOISE | 28 | 0 | 70 | 40 | 2.7 | none | apple | ios and ipados | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87940 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 3.8 | none | none | drupal | key auth | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-86955 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 2.7 | none | none | apple | ios and ipados | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-87936 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 5.8 | none | none | drupal | amazee.ai private ai provider | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-84923 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 8.5 | none | none | drupal | email verification / sms verification / otp verification | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-84910 | NOISE | 28 | 0 | 70 | 40 | 4.2 | 3.2 | none | none | drupal | advanced search | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96384 | NOISE | 28 | 0 | 70 | 40 | 3.5 | 7.2 | none | none | drupal | mermaid diagram field | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-76289 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 20.4 | none | none | splunk | splunk enterprise | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-87944 | NOISE | 28 | 0 | 70 | 40 | 4.8 | 0.7 | none | none | drupal | saml sso – service provider | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-87945 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 3.2 | none | none | drupal | saml sso – service provider | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-87948 | NOISE | 28 | 0 | 70 | 40 | 3.5 | 4.9 | none | none | drupal | saml sso – service provider | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-87949 | NOISE | 28 | 0 | 70 | 40 | 3.3 | 4.9 | none | none | drupal | saml sso – service provider | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-113868 | NOISE | 28 | 0 | 70 | 40 | 5.3 | 35.7 | none | none | mozilla | thunderbird | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-16648 | NOISE | 28 | 0 | 70 | 40 | 3.8 | 3.8 | none | none | drupal | mailer plus log | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-81163 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 4.9 | none | none | drupal | media library importer | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-105482 | NOISE | 28 | 0 | 70 | 40 | 7.4 | 36.4 | none | nodejs | node | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99040 | NOISE | 28 | 0 | 70 | 40 | 7.6 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99038 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99037 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99035 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99032 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 5.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99030 | NOISE | 28 | 0 | 70 | 40 | 7.5 | 39.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99028 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99027 | NOISE | 28 | 0 | 70 | 40 | 7.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99024 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99022 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99021 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99020 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99018 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 6.9 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99017 | NOISE | 28 | 0 | 70 | 40 | 7.0 | 5.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99016 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 6.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99014 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 5.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98995 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 5.3 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98993 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 7.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98992 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98991 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 4.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98989 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99041 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98987 | NOISE | 28 | 0 | 70 | 40 | 5.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98940 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98938 | NOISE | 28 | 0 | 70 | 40 | 4.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98936 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98935 | NOISE | 28 | 0 | 70 | 40 | 7.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98934 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98933 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98932 | NOISE | 28 | 0 | 70 | 40 | 7.4 | 7.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98927 | NOISE | 28 | 0 | 70 | 40 | 7.0 | 4.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98926 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98925 | NOISE | 28 | 0 | 70 | 40 | 8.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98923 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98920 | NOISE | 28 | 0 | 70 | 40 | 5.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98918 | NOISE | 28 | 0 | 70 | 40 | 5.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98917 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98916 | NOISE | 28 | 0 | 70 | 40 | 6.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98915 | NOISE | 28 | 0 | 70 | 40 | 6.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98909 | NOISE | 28 | 0 | 70 | 40 | 8.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98908 | NOISE | 28 | 0 | 70 | 40 | 6.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98907 | NOISE | 28 | 0 | 70 | 40 | 7.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98906 | NOISE | 28 | 0 | 70 | 40 | 6.6 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98874 | NOISE | 28 | 0 | 70 | 40 | 8.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98873 | NOISE | 28 | 0 | 70 | 40 | 7.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-57845 | NOISE | 28 | 0 | 33 | 80 | 8.8 | 45.6 | none | huggingface | datasets | 2026-10-23 | no exploitation evidence in any monitored source | Apply the patch in huggingface/datasets pull request #8879; no fixed release version is named in the record. | |||
| CVE-2026-86975 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 4.0 | none | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86976 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 3.1 | none | none | apple | ios and ipados · macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-114654 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 28.2 | none | mongodb | c# driver | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114653 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 11.6 | none | mongodb | c# driver | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-86981 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 3.1 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-28850 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 4.0 | none | none | apple | visionos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-65356 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 5.9 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-65372 | NOISE | 28 | 0 | 70 | 40 | 4.7 | 10.3 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-65379 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 5.9 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-65396 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 10.8 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-84490 | NOISE | 28 | 0 | 70 | 40 | 2.0 | 7.7 | none | none | apple | ios and ipados | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-84547 | NOISE | 28 | 0 | 70 | 40 | 3.5 | 5.9 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-84613 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 7.1 | none | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86871 | NOISE | 28 | 0 | 70 | 40 | 5.9 | 5.9 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86874 | NOISE | 28 | 0 | 70 | 40 | 3.3 | 3.5 | none | none | apple | xcode | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86875 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 3.5 | none | none | apple | xcode | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86907 | NOISE | 28 | 0 | 70 | 40 | 4.4 | 3.9 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-43839 | NOISE | 28 | 10 | 50 | 40 | 8.7 | 18.6 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: automatable | Update ADAM-3600 to version 2.8.5.0 or later; all versions prior to 2.8.5.0 are affected. | ||
| CVE-2026-28329 | NOISE | 28 | 0 | 70 | 40 | 6.4 | none | none | solarwinds | solarwinds observability self-hosted | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-28330 | NOISE | 28 | 0 | 70 | 40 | 4.6 | none | none | solarwinds | solarwinds observability self-hosted | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113602 | NOISE | 28 | 24 | 25 | 40 | 5.3 | poc | poc_early | json-smart | json-smart | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-113400 | NOISE | 28 | 0 | 70 | 40 | 5.4 | none | none | mozilla | firefox · thunderbird | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113401 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | mozilla | firefox · thunderbird | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101765 | NOISE | 28 | 24 | 25 | 40 | 9.1 | none | none | oracle corporation | oracle communications billing and revenue management | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-113002 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113035 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113038 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113045 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113070 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113077 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76497 | NOISE | 28 | 0 | 70 | 40 | 6.6 | 1.5 | none | none | cisco | cisco telepresence video communication server (vcs) expressway | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-84913 | NOISE | 28 | 0 | 70 | 40 | 4.6 | 3.2 | none | none | drupal | ai translate | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96362 | NOISE | 28 | 0 | 70 | 40 | 4.2 | 5.4 | none | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-105483 | NOISE | 28 | 0 | 70 | 40 | 7.4 | 19.8 | none | nodejs | node | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-106070 | NOISE | 28 | 0 | 70 | 40 | 3.7 | 28.0 | none | nodejs | node | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-106071 | NOISE | 28 | 0 | 70 | 40 | 3.6 | 7.3 | none | nodejs | node | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-106072 | NOISE | 28 | 0 | 70 | 40 | 6.7 | 45.6 | none | nodejs | node | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-106073 | NOISE | 28 | 0 | 70 | 40 | 3.3 | 13.2 | none | nodejs | node | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-106074 | NOISE | 28 | 0 | 70 | 40 | 4.8 | 21.9 | none | nodejs | node | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107082 | NOISE | 28 | 24 | 13 | 50 | 8.8 | 9.7 | poc | poc_early | n/a | n/a | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-106069 | NOISE | 28 | 0 | 70 | 40 | 7.4 | 19.8 | none | nodejs | node | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105481 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 20.6 | none | nodejs | node | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99058 | NOISE | 28 | 0 | 70 | 40 | 7.6 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99055 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99065 | NOISE | 28 | 0 | 70 | 40 | 5.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99080 | NOISE | 28 | 0 | 70 | 40 | 4.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99076 | NOISE | 28 | 0 | 70 | 40 | 4.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99086 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99085 | NOISE | 28 | 0 | 70 | 40 | 5.6 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113951 | NOISE | 28 | 0 | 70 | 40 | 23.6 | none | apple | container | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98905 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98912 | NOISE | 28 | 0 | 70 | 40 | 8.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98913 | NOISE | 28 | 0 | 70 | 40 | 6.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98914 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111811 | REVIEW | 28 | 17 | 13 | 65 | 9.0 | 29.1 | none | none | apache software foundation | apache traffic server | 2026-10-21 | Unauthenticated network access to read, write and delete the shared proxy cache, but only when the experimental tsmemcache plugin is enabled, and no exploitation signal exists (EPSS 0.36%, no public exploit or detection template). | Upgrade to Apache Traffic Server 9.2.16, 10.1.5, or 10.2.1 (service restart required). If you cannot patch promptly, disable the experimental tsmemcache plugin and restrict cache-port access to trusted networks. | ||
| CVE-2026-52356 | NOISE | 28 | 24 | 13 | 50 | 8.8 | 63.3 | poc | poc_early | n/a | n/a | 2026-10-23 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-86979 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 2.7 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-103515 | NOISE | 28 | 0 | 70 | 40 | 2.7 | 13.3 | none | gitlab | gitlab | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96382 | NOISE | 28 | 0 | 70 | 40 | 4.6 | 3.9 | none | none | drupal | diba carousel slider | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-113066 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-96371 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 6.7 | none | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96368 | NOISE | 28 | 0 | 70 | 40 | 4.6 | 9.9 | none | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-113082 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-100132 | NOISE | 28 | 0 | 70 | 40 | 4.3 | none | adobe | acrobat for edge | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113399 | NOISE | 28 | 0 | 70 | 40 | none | mozilla | firefox · thunderbird | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-84916 | NOISE | 28 | 0 | 70 | 40 | 3.7 | 3.2 | none | none | drupal | islandora | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-113196 | NOISE | 28 | 0 | 70 | 40 | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-113466 | NOISE | 28 | 24 | 25 | 40 | 5.3 | poc | poc_early | n/a | minio | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-76306 | NOISE | 28 | 0 | 70 | 40 | 7.5 | 12.1 | none | splunk | splunk soar | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98930 | NOISE | 28 | 0 | 70 | 40 | 8.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99060 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112278 | NOISE | 28 | 24 | 25 | 40 | 6.5 | poc | poc_early | rdesktop | rdesktop | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-112102 | NOISE | 28 | 24 | 25 | 40 | 6.3 | poc | poc_early | axa group | nlp.js | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-98872 | NOISE | 28 | 0 | 70 | 40 | 11.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98876 | NOISE | 28 | 0 | 70 | 40 | 7.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98881 | NOISE | 28 | 0 | 70 | 40 | 7.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98885 | NOISE | 28 | 0 | 70 | 40 | 7.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98890 | NOISE | 28 | 0 | 70 | 40 | 8.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98891 | NOISE | 28 | 0 | 70 | 40 | 7.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98894 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98897 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98898 | NOISE | 28 | 0 | 70 | 40 | 7.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98900 | NOISE | 28 | 0 | 70 | 40 | 7.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-77937 | NOISE | 28 | 22 | 18 | 50 | 8.1 | 33.0 | poc | poc_early | letta-ai | letta | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-81212 | NOISE | 28 | 26 | 31 | 30 | 10.0 | none | ibm | datastage on cloud pak for data | 2026-10-20 | no exploitation evidence in any monitored source | Upgrade DataStage on Cloud Pak for Data to 5.4 patch 8 or later, following IBM’s software-hub upgrade instructions. | ||||
| CVE-2026-55826 | NOISE | 28 | 10 | 13 | 80 | 8.7 | 26.9 | none | stape-io | gtm-server-side-wordpress-plugin | 2026-10-23 | no exploitation evidence in any monitored source | Update the GTM Server Side plugin to version 2.1.48 or later. | |||
| CVE-2026-99087 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99074 | NOISE | 28 | 0 | 70 | 40 | 4.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99077 | NOISE | 28 | 0 | 70 | 40 | 7.4 | 25.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99067 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99043 | NOISE | 28 | 0 | 70 | 40 | 7.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98921 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115557 | NOISE | 28 | 0 | 45 | 65 | 9.4 | 44.8 | none | python software foundation | cpython | 2026-10-24 | no exploitation evidence in any monitored source | Upgrade to CPython 3.11.18, 3.12.16, 3.13.18 or 3.16.0 or later, which include the compromised-certificate denylist in the ssl module. | |||
| CVE-2026-99072 | NOISE | 28 | 0 | 70 | 40 | 4.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99071 | NOISE | 28 | 0 | 70 | 40 | 9.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99070 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99069 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99068 | NOISE | 28 | 0 | 70 | 40 | 5.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99066 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99062 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99059 | NOISE | 28 | 0 | 70 | 40 | 7.7 | 38.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99057 | NOISE | 28 | 0 | 70 | 40 | 7.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98985 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98982 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 5.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98956 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98953 | NOISE | 28 | 0 | 70 | 40 | 7.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98952 | NOISE | 28 | 0 | 70 | 40 | 7.3 | 31.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98951 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98950 | NOISE | 28 | 0 | 70 | 40 | 7.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98944 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 6.9 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98902 | NOISE | 28 | 0 | 70 | 40 | 7.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98901 | NOISE | 28 | 0 | 70 | 40 | 6.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98895 | NOISE | 28 | 0 | 70 | 40 | 7.0 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98889 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 6.3 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98999 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 7.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113122 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113098 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-96379 | NOISE | 28 | 0 | 70 | 40 | 3.9 | none | drupal | cookiecuttr | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87951 | NOISE | 28 | 0 | 70 | 40 | 3.8 | 3.8 | none | none | drupal | saml sso – service provider | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-87947 | NOISE | 28 | 0 | 70 | 40 | 4.8 | 0.8 | none | none | drupal | saml sso – service provider | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-87946 | NOISE | 28 | 0 | 70 | 40 | 4.8 | 3.8 | none | none | drupal | saml sso – service provider | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-87942 | NOISE | 28 | 0 | 70 | 40 | 4.6 | 4.9 | none | none | drupal | safedelete | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-87941 | NOISE | 28 | 0 | 70 | 40 | 3.8 | none | drupal | patreon | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105711 | NOISE | 28 | 0 | 70 | 40 | 3.5 | 10.9 | none | gitlab | gitlab | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76528 | NOISE | 28 | 0 | 70 | 40 | 2.6 | none | splunk | splunk soar | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76527 | NOISE | 28 | 0 | 70 | 40 | 2.6 | none | splunk | splunk soar | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76408 | NOISE | 28 | 0 | 70 | 40 | 6.0 | none | splunk | splunk soar | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76407 | NOISE | 28 | 0 | 70 | 40 | 2.1 | none | splunk | splunk soar | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98998 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98994 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98996 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98970 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98997 | NOISE | 28 | 0 | 70 | 40 | 5.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98969 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76287 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 11.5 | none | none | splunk | splunk enterprise | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-113333 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112144 | NOISE | 28 | 24 | 25 | 40 | 5.3 | poc | poc_early | satya-vinay | events-management-system | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-112190 | NOISE | 28 | 24 | 25 | 40 | 5.3 | poc | poc_early | webkul | aureus erp | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-112267 | NOISE | 28 | 24 | 25 | 40 | 6.5 | poc | poc_early | sgl-project | sglang | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-112147 | NOISE | 28 | 24 | 25 | 40 | 5.3 | poc | poc_early | ai-genius-automations | octoally | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-43850 | NOISE | 28 | 11 | 50 | 40 | 8.6 | 69.3 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: total technical impact | Update ADAM-3600 to version 2.8.5.0 or later; all versions prior to 2.8.5.0 are affected. | ||
| CVE-2026-43857 | NOISE | 28 | 11 | 50 | 40 | 8.6 | 51.5 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: total technical impact | Update ADAM-3600 to version 2.8.5.0 or later; all versions prior to 2.8.5.0 are affected. | ||
| CVE-2026-43858 | NOISE | 28 | 11 | 50 | 40 | 8.6 | 54.0 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: total technical impact | Update ADAM-3600 to version 2.8.5.0 or later; all versions prior to 2.8.5.0 are affected. | ||
| CVE-2026-43856 | NOISE | 28 | 11 | 50 | 40 | 8.6 | 52.8 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: total technical impact | Update ADAM-3600 firmware to version 2.8.5.0 or later; all versions prior to 2.8.5.0 are affected. | ||
| CVE-2026-113129 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113144 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113209 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113296 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113297 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113310 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113322 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87302 | NOISE | 28 | 24 | 25 | 40 | 9.1 | none | none | oracle corporation | oracle weblogic server | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-84915 | NOISE | 28 | 0 | 70 | 40 | 4.6 | 4.9 | none | none | drupal | component blocks | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-84919 | NOISE | 28 | 0 | 70 | 40 | 4.6 | 4.9 | none | none | drupal | photoswipe – responsive javascript modal image gallery | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-84921 | NOISE | 28 | 0 | 70 | 40 | 5.3 | 8.3 | none | none | drupal | webform submissions delete | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-84924 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 4.9 | none | none | drupal | email verification / sms verification / otp verification | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-28331 | NOISE | 28 | 0 | 70 | 40 | 4.4 | none | none | solarwinds | patch manager | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-86868 | NOISE | 28 | 0 | 70 | 40 | 9.7 | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76301 | NOISE | 28 | 0 | 70 | 40 | 6.0 | none | splunk | splunk enterprise | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76529 | NOISE | 28 | 0 | 70 | 40 | 6.0 | none | splunk | splunk soar | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-96387 | NOISE | 28 | 0 | 70 | 40 | 3.8 | 7.4 | none | none | drupal | stop administrator login | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96391 | NOISE | 28 | 0 | 70 | 40 | 8.8 | none | drupal | webform rest | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87955 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 3.7 | none | none | drupal | ultimate table field | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-112212 | NOISE | 28 | 0 | 70 | 40 | 7.5 | 8.2 | none | gitlab | gitlab | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101808 | NOISE | 28 | 24 | 25 | 40 | 9.1 | none | none | oracle corporation | oracle product workbench | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-86375 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | none | dell | application installer, | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98947 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109443 | NOISE | 28 | 29 | 5 | 50 | 8.8 | 52.5 | poc | poc_early | jd-opensource | joysafeter | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-98977 | NOISE | 28 | 0 | 70 | 40 | 7.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98979 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99000 | NOISE | 28 | 0 | 70 | 40 | 7.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98975 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 5.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2015-20128 | NOISE | 28 | 31 | 0 | 50 | 8.2 | 27.0 | poc | poc_early | foosun | dotnetcms | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2019-25778 | NOISE | 28 | 31 | 0 | 50 | 8.2 | 39.7 | poc | poc_early | seacms | seacms | 2026-10-22 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-93475 | REVIEW | 28 | 35 | 13 | 30 | 9.3 | none | none | eclipse foundation | eclipse threadx – netx duo | 2026-10-20 | Pre-auth, no-user-interaction out-of-bounds write in NetX Duo’s X.509 parser, reachable by any peer presenting a crafted certificate chain. No public exploit code or observed exploitation, and the affected RTOS stack is niche. | Upgrade NetX Duo to 6.5.2.202603 or later; versions up to and including 6.5.1.202602 are affected. Until the upgrade is scheduled, restrict TLS/DTLS client-certificate authentication to trusted peers and avoid verifying chains from untrusted servers. | |||
| CVE-2026-46652 | NOISE | 28 | 16 | 13 | 65 | 9.8 | 53.0 | none | intranda | goobi-viewer-core | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to goobi-viewer-core 26.05 or later; versions 24.03 through before 26.05 are affected. | |||
| CVE-2026-99084 | NOISE | 28 | 0 | 70 | 40 | 3.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99075 | NOISE | 28 | 0 | 70 | 40 | 8.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99054 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 5.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99053 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 6.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99051 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 4.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99046 | NOISE | 28 | 0 | 70 | 40 | 7.5 | 44.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99044 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99013 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 5.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99011 | NOISE | 28 | 0 | 70 | 40 | 7.1 | 13.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99010 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99006 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 5.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99004 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99045 | NOISE | 28 | 0 | 70 | 40 | 7.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99002 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 5.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99001 | NOISE | 28 | 0 | 70 | 40 | 5.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98976 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 3.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98974 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 5.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98971 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98966 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98964 | NOISE | 28 | 0 | 70 | 40 | 7.5 | 45.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98963 | NOISE | 28 | 0 | 70 | 40 | 6.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98962 | NOISE | 28 | 0 | 70 | 40 | 6.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98961 | NOISE | 28 | 0 | 70 | 40 | 5.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98960 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98958 | NOISE | 28 | 0 | 70 | 40 | 6.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99031 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98887 | NOISE | 28 | 0 | 70 | 40 | 11.5 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98886 | NOISE | 28 | 0 | 70 | 40 | 8.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98882 | NOISE | 28 | 0 | 70 | 40 | 8.6 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98880 | NOISE | 28 | 0 | 70 | 40 | 6.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98879 | NOISE | 28 | 0 | 70 | 40 | 7.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98878 | NOISE | 28 | 0 | 70 | 40 | 8.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99025 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99019 | NOISE | 28 | 0 | 70 | 40 | 7.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99008 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99050 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 4.8 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98965 | NOISE | 28 | 0 | 70 | 40 | 7.5 | 44.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98899 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 6.3 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98948 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114652 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 22.4 | none | mongodb | c# driver | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114651 | NOISE | 28 | 0 | 70 | 40 | 4.0 | 32.9 | none | mongodb | c# driver | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114649 | NOISE | 28 | 0 | 70 | 40 | 6.8 | 9.7 | none | mongodb | c# driver | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114648 | NOISE | 28 | 0 | 70 | 40 | 7.6 | 24.9 | none | mongodb | c# driver | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114647 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 17.4 | none | mongodb | c# driver | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114646 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 17.9 | none | mongodb | c# driver | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114644 | NOISE | 28 | 0 | 70 | 40 | 5.9 | 41.2 | none | mongodb | c# driver | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114643 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 30.8 | none | mongodb | c# driver | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113224 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113026 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-96363 | NOISE | 28 | 0 | 70 | 40 | 8.5 | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-96374 | NOISE | 28 | 0 | 70 | 40 | 4.2 | 0.7 | none | none | drupal | project browser | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-86914 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 5.0 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-96361 | NOISE | 28 | 0 | 70 | 40 | 4.6 | 10.4 | none | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96357 | NOISE | 28 | 0 | 70 | 40 | 4.6 | 5.9 | none | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-16255 | NOISE | 28 | 0 | 70 | 40 | 5.9 | 10.5 | none | gitlab | gitlab | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-14288 | NOISE | 28 | 0 | 70 | 40 | 3.1 | 14.4 | none | gitlab | gitlab | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-13319 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 11.8 | none | gitlab | gitlab | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-98931 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112378 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 1.9 | none | gitlab | gitlab | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112326 | NOISE | 28 | 0 | 70 | 40 | 3.1 | 7.0 | none | gitlab | gitlab | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105777 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 15.4 | none | gitlab | gitlab | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76305 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 18.8 | none | splunk | splunk soar | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76297 | NOISE | 28 | 0 | 70 | 40 | 4.2 | 1.1 | none | splunk | splunk enterprise | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87096 | NOISE | 28 | 0 | 70 | 40 | 3.3 | 2.4 | none | acronis | acronis cyber infrastructure | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91624 | NOISE | 28 | 24 | 25 | 40 | 9.1 | none | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-111925 | NOISE | 28 | 24 | 25 | 40 | 5.3 | poc | poc_early | mopidy | mopidy | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-112273 | NOISE | 28 | 24 | 25 | 40 | 5.3 | poc | poc_early | libtins | libtins | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-86921 | NOISE | 28 | 0 | 70 | 40 | 6.2 | 3.4 | none | none | apple | ios and ipados · macos · visionos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86928 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 2.7 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86932 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 2.7 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86953 | NOISE | 28 | 0 | 70 | 40 | 4.6 | 4.0 | none | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86962 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 4.8 | none | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86963 | NOISE | 28 | 0 | 70 | 40 | 5.9 | 3.1 | none | none | apple | ios and ipados | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86913 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 6.2 | none | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86915 | NOISE | 28 | 0 | 70 | 40 | 4.7 | 2.7 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86918 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 4.0 | none | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86933 | NOISE | 28 | 0 | 70 | 40 | 3.3 | 2.7 | none | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-8355 | NOISE | 28 | 0 | 63 | 50 | 5.4 | 7.4 | none | none | ibm | contextforge mcp gateway | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-86872 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 5.0 | none | none | apple | safari · visionos · watchos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-84911 | NOISE | 28 | 0 | 70 | 40 | 3.1 | 4.9 | none | none | drupal | ai (artificial intelligence) | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96398 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 7.4 | none | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96370 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 8.8 | none | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-113309 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-96369 | NOISE | 28 | 0 | 70 | 40 | 3.1 | 8.2 | none | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-84912 | NOISE | 28 | 0 | 70 | 40 | 4.6 | 3.2 | none | none | drupal | ai (artificial intelligence) | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-113212 | NOISE | 28 | 0 | 70 | 40 | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-113137 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113128 | NOISE | 28 | 0 | 70 | 40 | none | chrome | 2026-10-20 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-86959 | NOISE | 28 | 0 | 70 | 40 | 4.0 | none | apple | ios and ipados · macos | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86944 | NOISE | 28 | 0 | 70 | 40 | 3.9 | none | apple | ios and ipados · macos | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86935 | NOISE | 28 | 0 | 70 | 40 | 2.7 | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-28854 | NOISE | 28 | 0 | 70 | 40 | 4.0 | none | apple | macos | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98943 | NOISE | 28 | 0 | 70 | 40 | 7.0 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98972 | NOISE | 28 | 0 | 70 | 40 | 5.4 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98973 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98990 | NOISE | 28 | 0 | 70 | 40 | 7.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99009 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99029 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84582 | NOISE | 28 | 0 | 70 | 40 | 5.2 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84508 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 5.2 | none | none | apple | ios and ipados · macos · visionos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-98937 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-98955 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99023 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99036 | NOISE | 28 | 0 | 70 | 40 | 7.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99063 | NOISE | 28 | 0 | 70 | 40 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87939 | NOISE | 28 | 0 | 70 | 40 | 4.2 | 4.9 | none | none | drupal | feed block | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-84918 | NOISE | 28 | 0 | 70 | 40 | 3.7 | 0.8 | none | none | drupal | monobank payment api | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-113869 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 19.2 | none | none | mozilla | thunderbird | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-76406 | NOISE | 28 | 0 | 70 | 40 | 5.9 | 23.9 | none | splunk | splunk soar | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87953 | NOISE | 28 | 0 | 70 | 40 | 3.3 | 3.7 | none | none | drupal | saml sso – service provider | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-87954 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 3.7 | none | none | drupal | taxonomy term glossary | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96360 | NOISE | 28 | 0 | 70 | 40 | 3.5 | 5.9 | none | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96359 | NOISE | 28 | 0 | 70 | 40 | 4.6 | 6.2 | none | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-96367 | NOISE | 28 | 0 | 70 | 40 | 4.6 | 8.5 | none | none | drupal | webform | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-10632 | NOISE | 27 | 5 | 33 | 65 | 8.7 | 22.7 | none | zimbra | zimbra collaboration suite | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade Zimbra Collaboration Suite to 10.1.17 or later; versions below 10.1.17 are affected. | |||
| CVE-2017-20289 | NOISE | 27 | 21 | 25 | 40 | 7.5 | 60.4 | poc | poc_early | broadstreet | ad widget | 2026-10-22 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-112857 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 34.8 | none | none | axiomthemes | reprizo | 2026-10-23 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-112862 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 34.8 | none | none | xnau webdesign | participants database | 2026-10-23 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-79858 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 43.2 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-43834 | NOISE | 27 | 4 | 50 | 50 | 7.5 | 21.4 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-112268 | NOISE | 27 | 12 | 33 | 50 | 6.3 | poc | poc_early | sgl-project | sglang-router | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-114636 | NOISE | 27 | 10 | 21 | 65 | 8.7 | 16.3 | none | traefik | traefik | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to Traefik 3.7.14 or later; versions 3.7.13 and earlier are affected. | |||
| CVE-2026-112858 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 24.0 | none | none | axiomthemes | rhodos | 2026-10-23 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-114640 | NOISE | 27 | 10 | 21 | 65 | 8.7 | 9.6 | none | traefik | traefik | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to Traefik 3.7.14 or later; versions from 3.7.0 before 3.7.14 are affected. | |||
| CVE-2026-113356 | NOISE | 27 | 21 | 25 | 40 | 7.5 | poc | poc_early | dokuwiki | dokuwiki | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | ||||
| CVE-2026-95168 | NOISE | 27 | 22 | 25 | 40 | 7.8 | poc | poc_early | n/a | n/a | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | ||||
| CVE-2026-71253 | REVIEW | 27 | 21 | 25 | 40 | 9.8 | 28.2 | none | none | apache software foundation | apache johnzon | 2026-10-19 | Pre-authentication, no-user-interaction unsafe reflection in Apache Johnzon: untrusted JSON can name and static-initialise an arbitrary class. CVSS 9.8, but EPSS is 0.36% and no exploit code, Metasploit module or detection template is known. | Upgrade Apache Johnzon to 1.3.1 (javax namespace) or 2.2.0 (jakarta namespace) or later; versions 1.0.0 to before 1.3.1 and 2.0.0 to before 2.2.0 are affected. Restart the service after upgrading. If Johnzon parses untrusted JSON on an internet-facing endpoint, prioritise that path. | ||
| CVE-2026-112856 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 24.0 | none | none | themerex group | vagabonds | 2026-10-23 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-9589 | NOISE | 27 | 13 | 30 | 50 | 9.3 | none | none | unblu inc. | unblu spark | 2026-10-20 | CISA SSVC: total technical impact | Upgrade to Unblu Spark 8.37.2 or later; there is no fix for 7.x and no workaround for on-premises deployments (Unblu Cloud is already patched). | |||
| CVE-2026-112264 | NOISE | 27 | 22 | 25 | 40 | 7.8 | poc | poc_early | bentoml | bentoml | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | ||||
| CVE-2026-112859 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 24.0 | none | none | themerex group | little birdies | 2026-10-23 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-109440 | NOISE | 27 | 29 | 0 | 50 | 8.8 | 36.5 | poc | poc_early | ginlix-ai | langalpha | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-112855 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 24.0 | none | none | axiomthemes | redy | 2026-10-23 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-116165 | NOISE | 27 | 14 | 13 | 65 | 8.8 | none | parse-community | parse-server | 2026-10-25 | no exploitation evidence in any monitored source | Upgrade to Parse Server 8.6.101 or later, or 9.10.4-alpha.4 or later; see vendor advisory GHSA-qmg9-m772-5rm7. | ||||
| CVE-2026-105262 | NOISE | 27 | 15 | 13 | 65 | 8.0 | none | none | unknown | falang multilanguage for wordpress | 2026-10-21 | CISA SSVC: total technical impact | Update Falang multilanguage for WordPress to version 1.4.6 or later. | |||
| CVE-2026-112853 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 34.8 | none | none | axiomthemes | hallelujah | 2026-10-23 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-112846 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 24.0 | none | none | themerex group | save life | 2026-10-23 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-112847 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 24.0 | none | none | themerex | zensoul | 2026-10-23 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-112304 | NOISE | 27 | 21 | 25 | 40 | 7.5 | poc | poc_early | mindee | doctr | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | ||||
| CVE-2026-112851 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 24.0 | none | none | themerex group | hotlock | 2026-10-23 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-108983 | REVIEW | 27 | 31 | 13 | 32 | 9.8 | 22.8 | none | none | geovision inc. | gv-asmanager | 2026-10-19 | Pre-authentication, no-user-interaction flaw in GeoVision GV-ASManager’s web server (CVSS 9.8) with a stated fix, but no exploitation signal: EPSS 0.003, no KEV, no public exploit or detection template. | Upgrade GV-ASManager to 6.4.0 or later (6.3.0 is affected). Until the upgrade is scheduled, keep the web interface off the public internet – restrict it to trusted networks or place it behind a VPN. | ||
| CVE-2026-112776 | REVIEW | 27 | 21 | 25 | 40 | 9.8 | 21.6 | none | none | craftcms | cms | 2026-10-19 | Pre-authentication, no-user-interaction CVSS 9.8 authorization bypass in internet-facing Craft CMS, but exploitation requires a valid site-scoped GraphQL token and no public exploit or KEV listing exists; EPSS is 0.003. | Upgrade Craft CMS to 5.11.0 or later; versions 5.0.0 through 5.10.x are affected. If you cannot patch immediately, disable or restrict the GraphQL API and audit site-scoped tokens for cross-site access. | ||
| CVE-2026-77926 | NOISE | 27 | 29 | 0 | 50 | 8.8 | 52.2 | poc | poc_early | apconw | aix-db | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-112848 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 24.0 | none | none | aivahthemes | hostme v2 | 2026-10-23 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-114220 | REVIEW | 27 | 19 | 0 | 70 | 9.1 | 4.6 | none | none | newtype infortech | nt oneapp | 2026-10-22 | Pre-authentication, no user interaction, CVSS 9.1, and a fix exists in NT OneAPP 1.5.35. Exploitation is not observed and EPSS is 0.00158, but the attack requires only network adjacency, not internet exposure. | Update NT OneAPP to 1.5.35 or later. Until then, keep the application off untrusted adjacent networks and avoid sending credentials or sensitive data over connections it does not certificate-pin. | ||
| CVE-2026-87095 | NOISE | 27 | 10 | 58 | 30 | 9.1 | 14.5 | none | acronis | acronis cyber infrastructure | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade Acronis Cyber Infrastructure to build 6.0.1-112, 6.1.1-64, or 6.2.1-71 or later, per vendor advisory SEC-8128. | |||
| CVE-2026-12489 | NOISE | 27 | 3 | 70 | 30 | 6.5 | 9.4 | none | none | zyxel | ex3501-t0 firmware | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-112779 | REVIEW | 27 | 21 | 25 | 40 | 9.8 | 23.7 | none | none | getgrav | grav-plugin-api | 2026-10-19 | Unauthenticated, no-interaction CVSS 9.8 in the Grav API plugin, but the practical impact is disk/APCu exhaustion via the translations endpoint rather than remote code execution, and EPSS sits at 0.003 with no exploit code or KEV listing. | Upgrade grav-plugin-api to 1.0.42 or later (fixes 1.0.16 before 1.0.42 and 1.0.40 before 1.0.42), then restart the service. If you cannot patch promptly, restrict /api/v1/translations/ to trusted networks and monitor disk and APCu usage. | ||
| CVE-2026-103302 | NOISE | 27 | 12 | 33 | 50 | 5.3 | none | none | unknown | payment gateway for idram | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-101484 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 40.6 | none | none | oracle corporation | oracle secure backup | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-101521 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 43.2 | none | none | oracle corporation | oracle apex | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-91299 | NOISE | 27 | 21 | 25 | 40 | 10.0 | 39.7 | none | none | oracle corporation | jd edwards enterpriseone orchestrator | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-114102 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 20.5 | poc | poc_early | cthackers | adm-zip | 2026-10-21 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-112904 | NOISE | 26 | 5 | 13 | 80 | 8.7 | 26.7 | none | givanz | vvveb | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to a Vvveb build containing commit aa29cb013e5037d75f6780741bac6b69b9d403a2, which adds sanitizeFileName() to nextRestore() and nextBackup(). | |||
| CVE-2026-98984 | NOISE | 26 | 0 | 65 | 40 | 6.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91221 | NOISE | 26 | 26 | 1 | 49 | 10.0 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-13695 | NOISE | 26 | 19 | 25 | 40 | 8.8 | 12.7 | none | none | integratec | integratec | 2026-10-19 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-80312 | NOISE | 26 | 14 | 25 | 50 | 8.2 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: automatable | Upgrade to Apache Camel 4.23.0; users on the 4.18.x LTS stream should upgrade to 4.18.5 and users on the 4.22.x LTS stream to 4.22.1. | |||
| CVE-2026-43846 | NOISE | 26 | 6 | 50 | 40 | 8.6 | 26.5 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: total technical impact | Update ADAM-3600 to version 2.8.5.0 or later; all versions prior to 2.8.5.0 are affected. | ||
| CVE-2026-43843 | NOISE | 26 | 7 | 50 | 40 | 6.9 | 18.6 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-115971 | NOISE | 26 | 19 | 25 | 40 | 5.3 | 30.9 | poc | poc_early | travisun | opptrix | 2026-10-24 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-112900 | REVIEW | 26 | 19 | 25 | 40 | 9.2 | 36.1 | none | none | python-pillow | pillow | 2026-10-19 | Pre-auth, no-user-interaction argument injection in Pillow’s EPS handling, but exploitation requires the attacker to control the input filename and a referenced argument file, and EPSS is 0.004 with no public exploit or detection template observed. | Upgrade Pillow to 13.0.0 or later and restart the service. Where upgrade is delayed, avoid processing untrusted EPS files or disable Ghostscript-backed EPS handling until the library is updated. | ||
| CVE-2026-114260 | NOISE | 26 | 19 | 25 | 40 | 6.5 | 46.0 | poc | poc_early | oretnom23 | file-management-system-php | 2026-10-21 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-114257 | NOISE | 26 | 20 | 25 | 40 | 7.3 | 34.1 | poc | poc_early | oretnom23 | file-management-system-php | 2026-10-21 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2022-51023 | NOISE | 26 | 12 | 13 | 65 | 8.2 | none | phpok | phpok | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade PHPOK to 5.4.081 or later; the fix is in commit d70c396f. | ||||
| CVE-2026-50053 | NOISE | 26 | 10 | 33 | 50 | 8.7 | 22.7 | none | zimbra | zimbra collaboration suite | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114383 | NOISE | 26 | 16 | 21 | 50 | 10.0 | 50.7 | none | totolink | ex200 | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76526 | NOISE | 26 | 7 | 58 | 30 | 8.8 | 6.0 | none | none | splunk | splunk soar | 2026-10-21 | CISA SSVC: total technical impact | Upgrade Splunk SOAR to version 8.7.0 or higher. | ||
| CVE-2026-113658 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 49.1 | poc | poc_early | apostrophecms | apostrophe | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2016-20100 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 44.4 | poc | poc_early | ian howatson | memphis documents library | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2016-20104 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 49.1 | poc | poc_early | eyelock | nano nxt | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-105869 | NOISE | 26 | 10 | 18 | 65 | 9.2 | 21.9 | none | apache software foundation | apache pulsar | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to Apache Pulsar 4.0.14 or later for 4.0.x, or 4.2.5 or later for 4.1.x/4.2.x; if unable to upgrade, remove the anonymousUserRole setting or restrict network access to HTTP endpoints. | |||
| CVE-2026-114109 | NOISE | 26 | 0 | 33 | 70 | 8.8 | 30.9 | none | astral-sh | uv | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade uv to 0.11.15 or later, which is unaffected by this path traversal. | |||
| CVE-2026-14511 | NOISE | 26 | 0 | 50 | 55 | 6.5 | 25.7 | none | none | ibm | mq 9.4.5.0, 9.4.5.1 | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-91265 | NOISE | 26 | 19 | 25 | 40 | 9.1 | 30.5 | none | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-115547 | NOISE | 26 | 7 | 38 | 50 | 9.1 | 42.2 | none | none | okta | okta access gateway | 2026-10-23 | CISA SSVC: total technical impact | Upgrade the Okta Access Gateway appliance to version 2026.10.2 or later. | ||
| CVE-2026-80343 | NOISE | 26 | 14 | 25 | 50 | 8.2 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: automatable | Upgrade to Apache Camel 4.23.0; 4.18.x LTS users to 4.18.5 or later, 4.22.x LTS users to 4.22.1 or later. | |||
| CVE-2026-112093 | NOISE | 26 | 19 | 25 | 40 | 4.3 | 18.5 | poc | poc_early | subhajitkhan | online-clinic-management-system | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-79881 | NOISE | 26 | 10 | 33 | 49 | 8.3 | 38.7 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115353 | NOISE | 26 | 3 | 33 | 65 | 8.6 | none | lepture | mistune | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to mistune 3.3.0 or later, which is unaffected by this path traversal. | ||||
| CVE-2026-112083 | NOISE | 26 | 19 | 25 | 40 | 5.3 | 34.8 | poc | poc_early | sgl-project | sglang | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-112940 | NOISE | 26 | 0 | 33 | 70 | 7.1 | 1.5 | poc | poc_early | tox-dev | filelock | 2026-10-20 | CISA SSVC: public proof of concept | Upgrade filelock to version 4.2.1 or later. | ||
| CVE-2026-58202 | NOISE | 26 | 10 | 18 | 65 | 8.3 | 14.5 | none | open-reception | appointment-booking-software | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to version 2.0.0 or later, which builds confirmation links from the trusted tenant domain instead of the request Host. | |||
| CVE-2026-87337 | NOISE | 26 | 26 | 1 | 49 | 10.0 | none | oracle corporation | oracle access manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-79886 | NOISE | 26 | 10 | 33 | 50 | 8.2 | 30.3 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112247 | NOISE | 26 | 19 | 25 | 40 | 4.3 | 17.1 | poc | poc_early | wuxi wubang security software | five-in-one safety production management information system | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-112252 | NOISE | 26 | 20 | 25 | 40 | 7.3 | 16.6 | poc | poc_early | wuxi wubang security software | wubang five-in-one safety production management information system | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-113381 | NOISE | 26 | 20 | 25 | 40 | 7.3 | 32.1 | poc | poc_early | n/a | osclass | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-43849 | NOISE | 26 | 7 | 50 | 40 | 6.9 | 35.5 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-113605 | NOISE | 26 | 20 | 25 | 40 | 7.2 | poc | poc_early | stirling-tools | stirling-pdf | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | ||||
| CVE-2026-101468 | NOISE | 26 | 13 | 38 | 40 | 7.5 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-112394 | NOISE | 26 | 19 | 25 | 40 | 6.3 | 20.6 | poc | poc_early | python-pillow | pillow | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-101590 | NOISE | 26 | 19 | 25 | 40 | 9.1 | 30.5 | none | none | oracle corporation | helidon | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-91305 | NOISE | 26 | 19 | 25 | 40 | 9.1 | 30.5 | none | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-112954 | NOISE | 26 | 19 | 25 | 40 | 5.3 | 38.4 | poc | poc_early | apostrophecms | apostrophe | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-113507 | NOISE | 26 | 19 | 25 | 40 | 5.3 | 40.5 | poc | poc_early | n/a | aapanel | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-114441 | NOISE | 26 | 20 | 25 | 40 | 7.3 | 35.9 | poc | poc_early | oretnom23 | php-travel-agency-system | 2026-10-21 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-115324 | NOISE | 26 | 12 | 13 | 65 | 8.1 | none | mem0ai | mem0 | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade mem0 to 1.0.8 or later; versions 0.1.117 through 1.0.7 are affected. | ||||
| CVE-2026-91403 | NOISE | 26 | 19 | 25 | 40 | 9.1 | 24.1 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-21 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-116211 | NOISE | 26 | 12 | 13 | 65 | 8.2 | none | yeswiki | yeswiki | 2026-10-25 | no exploitation evidence in any monitored source | Upgrade to YesWiki 4.7.0 or later; versions 4.5.0 through 4.6.x are affected. | ||||
| CVE-2026-116208 | NOISE | 26 | 12 | 13 | 65 | 8.1 | none | yeswiki | yeswiki | 2026-10-25 | no exploitation evidence in any monitored source | Upgrade YesWiki to 4.7.0 or later; versions from 4.6.2 before 4.7.0 are affected. | ||||
| CVE-2026-116204 | NOISE | 26 | 12 | 13 | 65 | 8.1 | none | yeswiki | yeswiki | 2026-10-25 | no exploitation evidence in any monitored source | Upgrade YesWiki to 4.7.0 or later, which is unaffected by this CSRF flaw. | ||||
| CVE-2026-116176 | NOISE | 26 | 12 | 13 | 65 | 8.2 | none | vllm-project | vllm | 2026-10-25 | no exploitation evidence in any monitored source | Upgrade vLLM to 0.24.0 or later; versions from 0.9.2 before 0.24.0 are affected. | ||||
| CVE-2026-115506 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 39.2 | poc | poc_early | libexpat | libexpat | 2026-10-22 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-112036 | NOISE | 26 | 19 | 25 | 40 | 4.3 | 25.7 | poc | poc_early | artifex | mupdf | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-112040 | NOISE | 26 | 19 | 25 | 40 | 4.3 | 16.4 | poc | poc_early | diem-project | diem | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-112075 | NOISE | 26 | 19 | 25 | 40 | 6.3 | 24.0 | poc | poc_early | unslothai | unsloth | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-79885 | NOISE | 26 | 10 | 33 | 49 | 8.2 | 32.6 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112079 | NOISE | 26 | 19 | 25 | 40 | 6.3 | 16.8 | poc | poc_early | hankcs | hanlp | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-112082 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 49.0 | poc | poc_early | sgl-project | sglang | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-114401 | NOISE | 26 | 19 | 25 | 40 | 5.3 | 37.1 | poc | poc_early | polonel | trudesk | 2026-10-21 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2015-20124 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 31.8 | poc | poc_early | aspose | aspose importer & exporter | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-53986 | NOISE | 26 | 19 | 25 | 40 | 5.3 | 11.4 | poc | poc_early | girafit | girafit camera app | 2026-10-21 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-15661 | NOISE | 26 | 7 | 50 | 40 | 5.3 | 22.6 | none | none | ibm | concert | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-112091 | NOISE | 26 | 19 | 25 | 40 | 5.3 | 22.6 | poc | poc_early | dav-ee | dairy-management-system | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-3628 | NOISE | 26 | 7 | 50 | 40 | 5.3 | 24.9 | none | none | ibm | concert | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-115534 | NOISE | 26 | 19 | 25 | 40 | 4.3 | 27.4 | poc | poc_early | gedelumbung | hospitalmanagement | 2026-10-23 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-115537 | NOISE | 26 | 19 | 25 | 40 | 4.3 | 25.2 | poc | poc_early | gedelumbung | hospitalmanagement | 2026-10-23 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2024-58396 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 42.4 | poc | poc_early | youdatasum | cpas audit management system | 2026-10-22 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-114254 | NOISE | 26 | 20 | 25 | 40 | 7.3 | 35.9 | poc | poc_early | oretnom23 | file-management-system-php | 2026-10-21 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-114263 | NOISE | 26 | 20 | 25 | 40 | 7.3 | 26.2 | poc | poc_early | projectworlds | advanced library management system | 2026-10-21 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-116000 | NOISE | 26 | 20 | 25 | 40 | 7.3 | 21.2 | poc | poc_early | zylon | privategpt | 2026-10-25 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-114820 | NOISE | 26 | 19 | 25 | 40 | 9.1 | 16.6 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-24 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-116149 | NOISE | 26 | 2 | 33 | 65 | 8.1 | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | Upgrade to ImageMagick 6.9.13-58 or later, or 7.1.2-33 or later. | ||||
| CVE-2026-113744 | NOISE | 26 | 26 | 0 | 50 | 10.0 | none | tenda | ac19 | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116049 | NOISE | 26 | 20 | 25 | 40 | 7.3 | 16.8 | poc | poc_early | krupalshah | employeerecruitmentsystem | 2026-10-25 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-43842 | NOISE | 26 | 7 | 50 | 40 | 6.9 | 18.6 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-43841 | NOISE | 26 | 7 | 50 | 40 | 6.9 | 18.6 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-107400 | NOISE | 26 | 7 | 50 | 40 | 8.8 | 36.8 | none | none | ibm | tririga application platform | 2026-10-20 | CISA SSVC: total technical impact | Upgrade to IBM TRIRIGA Application Platform 5.0.9 or a later supported release containing the fix. | ||
| CVE-2026-109126 | NOISE | 26 | 7 | 50 | 40 | 8.8 | 7.0 | none | none | ibm | verify identity access · security verify access | 2026-10-20 | CISA SSVC: total technical impact | Update IBM Verify Identity Access to v11.0.3.2 or IBM Security Verify Access to v10.0.9.4 via IBM Fix Central. | ||
| CVE-2026-105453 | NOISE | 26 | 6 | 50 | 40 | 8.4 | 0.6 | none | none | ibm | sterling connect direct for unix | 2026-10-20 | CISA SSVC: total technical impact | Apply 6.3.0.7.iFix030 (included in 6.3.0.7.iFix033) for 6.3.0.0-6.3.0.7, or 6.4.0.6.iFix021 for 6.4.0.0-6.4.0.6, available from IBM Fix Central. | ||
| CVE-2026-107366 | NOISE | 26 | 6 | 50 | 40 | 8.3 | 11.7 | none | none | ibm | langflow oss | 2026-10-20 | CISA SSVC: total technical impact | Upgrade Langflow OSS to version 1.12.5; IBM also recommends setting LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true for deployments using MCP stdio, in addition to upgrading. | ||
| CVE-2026-114612 | NOISE | 25 | 6 | 21 | 65 | 9.9 | 24.6 | none | berriai | litellm | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2 or later. | |||
| CVE-2026-114113 | NOISE | 25 | 0 | 33 | 65 | 8.4 | 1.1 | none | lovell | sharp | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade sharp to 0.35.0 or later, which bundles a libvips version not affected by these decoder flaws. | |||
| CVE-2026-114111 | NOISE | 25 | 0 | 33 | 65 | 8.9 | 2.3 | none | lovell | sharp | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade sharp to 0.35.5 or later, which no longer bundles the affected librsvg dependency. | |||
| CVE-2026-55486 | NOISE | 25 | 10 | 13 | 65 | 9.3 | 17.2 | none | intranda | goobi-viewer-core | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to Goobi viewer core 26.05 or later; versions from 25.08 before 26.05 are affected. | |||
| CVE-2026-114053 | NOISE | 25 | 10 | 13 | 65 | 8.1 | 39.0 | none | vllm-project | vllm | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade vLLM to 0.31.0 or later; versions from 0.7.3 before 0.31.0 are affected. | |||
| CVE-2026-109395 | REVIEW | 25 | 11 | 13 | 65 | 9.1 | 33.1 | none | none | ning | compress-lzf | 2026-10-20 | Pre-auth, no-interaction heap disclosure or JVM crash from crafted LZF streams, but exploitation is unconfirmed (EPSS 0.004, no public exploit or detection template) and the library is niche. | Upgrade compress-lzf to 1.2.0 or later and restart dependent services. Until then, avoid decompressing untrusted LZF input and restrict any endpoint that accepts attacker-supplied compressed data. | ||
| CVE-2026-105312 | NOISE | 25 | 14 | 30 | 40 | 9.9 | none | none | red hat | streamshub console for apache kafka® · streams for apache kafka 2 · streams for apache kafka 3 | 2026-10-20 | CISA SSVC: total technical impact | No patch stated; restrict create/update/patch on consoles.console.streamshub.github.com to cluster administrators and add an admission policy (OPA/Gatekeeper, Kyverno) validating spec.containers.api.spec.image. | |||
| CVE-2026-91225 | NOISE | 25 | 24 | 1 | 49 | 9.1 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112953 | NOISE | 25 | 12 | 25 | 50 | 6.0 | poc | poc_early | apostrophecms, @apostrophecms | apostrophe · import-export | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-56840 | NOISE | 25 | 10 | 13 | 65 | 8.8 | 15.7 | none | mervinpraison | praisonai | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade PraisonAI to version 4.6.59 or later. | |||
| CVE-2026-113603 | NOISE | 25 | 12 | 25 | 50 | 6.5 | none | none | x402-foundation | @x402/extensions · github.com/x402-foundation/x402/go/v2 | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-113657 | NOISE | 25 | 12 | 25 | 50 | 3.7 | poc | poc_early | apostrophecms | apostrophe · sanitize-html | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112912 | NOISE | 25 | 12 | 25 | 50 | 2.5 | poc | poc_early | tox-dev | filelock | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-86055 | NOISE | 25 | 10 | 13 | 65 | 8.7 | 33.9 | none | part-db | part-db-server | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to Part-DB-server 2.13.3 or later, which validates the Host header when building password-reset links. | |||
| CVE-2026-112934 | NOISE | 25 | 0 | 33 | 65 | 6.1 | 3.2 | poc | poc_early | tox-dev | filelock | 2026-10-20 | CISA SSVC: public proof of concept | Upgrade filelock to version 4.2.1 or later. | ||
| CVE-2026-113388 | NOISE | 25 | 12 | 25 | 50 | 4.3 | poc | poc_early | n/a | opensource-socialnetwork | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-113671 | NOISE | 25 | 12 | 25 | 50 | 4.3 | poc | poc_early | apostrophecms, @apostrophecms | apostrophe · ai-helper | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-43855 | NOISE | 25 | 4 | 50 | 40 | 7.5 | 47.0 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-114126 | NOISE | 25 | 0 | 33 | 65 | 8.7 | 40.6 | none | storybookjs | storybook | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to Storybook 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6 or later. | |||
| CVE-2026-13599 | NOISE | 25 | 5 | 50 | 40 | 7.8 | 2.6 | none | none | abb | ability edgenius | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2022-51026 | NOISE | 25 | 11 | 13 | 65 | 9.8 | 49.0 | none | bytebase | bytebase | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade Bytebase to 1.0.1 or later; the fix is in the 1.0.1 release (patch commit d69e682, PR #834). | |||
| CVE-2016-20101 | NOISE | 25 | 10 | 13 | 65 | 8.1 | 32.9 | none | pedro marcelo | issuu panel | 2026-10-20 | no exploitation evidence in any monitored source | Update the Issuu Panel WordPress plugin to version 1.6.6 or later. | |||
| CVE-2026-84180 | NOISE | 25 | 12 | 25 | 50 | 5.3 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-108359 | NOISE | 25 | 0 | 33 | 65 | 8.7 | 34.7 | none | phpoffice | phpspreadsheet | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to PhpSpreadsheet 1.30.7, 2.1.19, 2.4.8, 3.10.8, or 5.10.0 or later. | |||
| CVE-2026-96640 | NOISE | 25 | 0 | 33 | 65 | 8.2 | 35.4 | none | python-pillow | pillow | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade Pillow to version 13.0.0 or later, which fixes the issue. | |||
| CVE-2026-113722 | NOISE | 25 | 17 | 25 | 40 | 7.8 | 20.9 | poc | poc_early | pypa | virtualenv | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-93888 | NOISE | 25 | 5 | 50 | 40 | 7.8 | 6.1 | none | none | ibm | sterling connect direct for unix | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91231 | NOISE | 25 | 26 | 0 | 49 | 10.0 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112399 | NOISE | 25 | 0 | 33 | 65 | 8.7 | 20.4 | none | python-pillow | pillow | 2026-10-19 | no exploitation evidence in any monitored source | Upgrade to Pillow 13.0.0 or later; versions from 8.1.0 through 13.0.0 are affected. | |||
| CVE-2026-104641 | NOISE | 25 | 12 | 25 | 50 | 5.3 | none | none | unknown | simple shopping cart | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-98893 | NOISE | 25 | 0 | 70 | 30 | 7.6 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-58497 | NOISE | 25 | 18 | 25 | 40 | 8.6 | 17.0 | none | none | olo-dot-io | uni-cli | 2026-10-23 | CISA SSVC: automatable; CISA SSVC: total technical impact | Upgrade Uni-CLI to version 0.225.2 or later, which enforces the browser-to-localhost Origin check on the legacy HTTP transport. | ||
| CVE-2026-115414 | NOISE | 25 | 10 | 30 | 50 | 7.8 | 58.7 | none | none | aws | aws-sam-cli | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-111181 | NOISE | 25 | 13 | 25 | 50 | 7.5 | none | none | body-parser | body-parser | 2026-10-22 | CISA SSVC: automatable | ||||
| CVE-2026-86471 | NOISE | 25 | 13 | 25 | 50 | 9.3 | none | none | apache software foundation | apache couchdb | 2026-10-20 | CISA SSVC: total technical impact | Upgrade to Apache CouchDB 3.5.3 or later, which fixes this issue. | |||
| CVE-2026-98892 | NOISE | 25 | 0 | 70 | 30 | 8.2 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114611 | NOISE | 25 | 10 | 13 | 65 | 9.1 | 13.5 | none | schorschii | oco-server | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade OCO-Server to 1.2.3 or later, which fixes the MDM enrollment signature verification. | |||
| CVE-2026-46651 | NOISE | 25 | 11 | 13 | 65 | 9.8 | 31.5 | none | intranda | goobi-viewer-core | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade goobi-viewer-core to version 26.05 or later, which patches the unauthenticated DownloadTaskEndpoint WebSocket issue. | |||
| CVE-2026-111809 | NOISE | 25 | 10 | 13 | 65 | 9.3 | 11.6 | none | apache software foundation | apache traffic server | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to Apache Traffic Server 9.2.16, 10.1.5, or 10.2.1, which fix the issue. | |||
| CVE-2026-96639 | NOISE | 25 | 1 | 33 | 65 | 9.8 | 46.2 | none | python-pillow | pillow | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade Pillow to version 13.0.0 or later; versions from 11.0.0 through 12.x are affected. | |||
| CVE-2026-98871 | NOISE | 25 | 0 | 70 | 30 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-85250 | NOISE | 25 | 13 | 25 | 50 | 7.5 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-112305 | NOISE | 25 | 12 | 25 | 50 | 8.8 | none | none | semaphoreui | semaphore ui | 2026-10-19 | CISA SSVC: total technical impact | ||||
| CVE-2026-91341 | NOISE | 25 | 24 | 1 | 50 | 9.1 | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110803 | NOISE | 25 | 10 | 13 | 65 | 8.7 | 19.2 | none | vaadin | framework | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade com.vaadin:vaadin-server (and vaadin-server-mpr-jakarta) to 8.32.2 or later; Vaadin Framework 7 and Vaadin 10+ are not affected. | |||
| CVE-2026-56836 | NOISE | 25 | 10 | 13 | 65 | 8.2 | 13.3 | none | mervinpraison | praisonai | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade PraisonAI to version 4.6.59 or later, which patches the unauthenticated recipe server exposure. | |||
| CVE-2026-85642 | NOISE | 25 | 13 | 33 | 40 | 7.5 | none | none | unknown | formidable forms | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-91230 | NOISE | 25 | 25 | 1 | 49 | 9.3 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115775 | NOISE | 25 | 10 | 13 | 65 | 8.7 | 38.3 | none | twisted | twisted | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to Twisted 26.10.0rc1 or later, which fixes the unbounded stanza parsing. | |||
| CVE-2026-91303 | NOISE | 25 | 24 | 1 | 49 | 8.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-43837 | NOISE | 25 | 4 | 50 | 40 | 7.5 | 29.0 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-99081 | NOISE | 25 | 0 | 70 | 30 | 7.5 | 39.7 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112404 | NOISE | 25 | 0 | 33 | 65 | 8.8 | 20.4 | none | python-pillow | pillow | 2026-10-19 | no exploitation evidence in any monitored source | Upgrade Pillow to version 13.0.0 or later; versions from 8.1.0 through 13.0.0 are affected. | |||
| CVE-2026-99003 | NOISE | 25 | 0 | 70 | 30 | 6.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-55888 | NOISE | 25 | 0 | 33 | 65 | 8.8 | 32.0 | none | flatpak | xdg-desktop-portal | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade xdg-desktop-portal to version 1.22.1 or later. | |||
| CVE-2026-98875 | NOISE | 25 | 0 | 70 | 30 | 6.6 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87397 | NOISE | 25 | 24 | 1 | 50 | 8.8 | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91296 | NOISE | 25 | 24 | 1 | 49 | 8.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112893 | NOISE | 25 | 0 | 33 | 65 | 8.2 | 20.4 | none | python-pillow | pillow | 2026-10-19 | no exploitation evidence in any monitored source | Upgrade to Pillow 13.0.0 or later; versions from 10.0.0 through 13.0.0 are affected. | |||
| CVE-2026-105999 | NOISE | 25 | 12 | 25 | 50 | 5.3 | none | none | unknown | booking package | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-101495 | NOISE | 25 | 24 | 1 | 49 | 8.8 | none | oracle corporation | siebel crm development | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105998 | NOISE | 25 | 12 | 25 | 50 | 5.3 | none | none | unknown | booking package | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-114575 | NOISE | 24 | 16 | 13 | 50 | 10.0 | 82.5 | none | totolink | a950rg | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91358 | NOISE | 24 | 22 | 1 | 49 | 8.2 | none | oracle corporation | oracle business process management suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91353 | NOISE | 24 | 23 | 1 | 50 | 8.6 | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2023-38375 | NOISE | 24 | 0 | 55 | 40 | 6.1 | 15.8 | none | none | ibm | cloud pak system | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-63244 | NOISE | 24 | 16 | 13 | 49 | 9.8 | 51.1 | none | wizlearn technologies pte. ltd. | learning management system | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-71195 | NOISE | 24 | 6 | 18 | 65 | 9.9 | 40.7 | none | openstack | manila | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade Manila to 23.0.1 or later (or 22.0.2, 21.0.3, 20.0.3 on older branches) per OSSA-2026-046. | |||
| CVE-2026-87346 | NOISE | 24 | 23 | 1 | 50 | 8.7 | none | oracle corporation | oracle http server | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91370 | NOISE | 24 | 12 | 30 | 40 | 5.3 | none | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-92853 | NOISE | 24 | 15 | 25 | 40 | 8.7 | none | none | eclipse foundation | eclipse threadx – netx duo | 2026-10-20 | CISA SSVC: automatable | Upgrade NetX Duo to 6.5.2.202603 or later; versions up to and including 6.5.1.202602 are affected. | |||
| CVE-2026-91371 | NOISE | 24 | 12 | 30 | 40 | 5.8 | none | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-94018 | NOISE | 24 | 16 | 25 | 40 | 8.8 | none | none | eclipse foundation | eclipse threadx – netx duo | 2026-10-20 | CISA SSVC: automatable | Upgrade to NetX Duo 6.5.2.202603 or later; versions 6.4.2 through 6.5.1.202602 are affected. | |||
| CVE-2026-111767 | NOISE | 24 | 15 | 25 | 40 | 8.6 | none | none | modelcontextprotocol | typescript-sdk | 2026-10-20 | CISA SSVC: automatable | Upgrade to typescript-sdk 1.32.0 or later; versions 1.24.0 through before 1.32.0 are affected. | |||
| CVE-2026-101427 | NOISE | 24 | 22 | 1 | 49 | 8.1 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91534 | NOISE | 24 | 15 | 25 | 40 | 8.6 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-91273 | NOISE | 24 | 23 | 1 | 50 | 8.6 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2021-48016 | NOISE | 24 | 16 | 13 | 50 | 9.8 | none | dedecms | dedecms | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105297 | NOISE | 24 | 8 | 30 | 50 | 7.5 | 25.8 | none | none | cloudflare | https://github.com/cloudflare/pingora | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-91342 | NOISE | 24 | 22 | 1 | 50 | 8.2 | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91343 | NOISE | 24 | 23 | 1 | 50 | 8.6 | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101458 | NOISE | 24 | 22 | 1 | 49 | 8.2 | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83409 | NOISE | 24 | 22 | 1 | 49 | 8.1 | none | oracle corporation | oracle access manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116191 | NOISE | 24 | 13 | 30 | 40 | 7.5 | none | none | rclone | rclone | 2026-10-25 | CISA SSVC: automatable | ||||
| CVE-2026-91252 | NOISE | 24 | 22 | 1 | 50 | 8.2 | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101634 | NOISE | 24 | 16 | 25 | 40 | 9.1 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-87304 | NOISE | 24 | 23 | 1 | 50 | 8.6 | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91219 | NOISE | 24 | 23 | 1 | 50 | 8.6 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114083 | NOISE | 24 | 12 | 6 | 65 | 8.1 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to Trigger.dev 4.5.0-rc.3 or later, which is unaffected by this path traversal. | ||||
| CVE-2026-106010 | NOISE | 24 | 7 | 33 | 50 | 5.3 | 7.3 | none | none | unknown | bdm digital payment gateway | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-19178 | NOISE | 24 | 3 | 50 | 40 | 6.8 | 8.1 | none | none | ibm | storage ts4500 library | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-116201 | NOISE | 24 | 9 | 13 | 65 | 8.8 | none | grokability | snipe-it | 2026-10-25 | no exploitation evidence in any monitored source | Upgrade to Snipe-IT 8.5.0 or later, which is unaffected. | ||||
| CVE-2026-114135 | NOISE | 24 | 5 | 21 | 65 | 8.8 | 31.5 | none | jupyter-server | jupyter_server | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to jupyter_server 2.6.0 or later, which fixes the default gateway configuration; avoid manually registering the deprecated jupyter_server.gateway.handlers module. | |||
| CVE-2026-4418 | NOISE | 24 | 0 | 55 | 40 | 5.4 | none | none | ibm | cloud pak system | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-3295 | NOISE | 24 | 1 | 55 | 40 | 7.4 | none | none | ibm | cloud pak system | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112101 | NOISE | 24 | 12 | 33 | 40 | 4.3 | poc | poc_early | blackbelttechnology | pi-agent-dashboard | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-87300 | NOISE | 24 | 23 | 1 | 49 | 8.7 | none | oracle corporation | oracle weblogic server proxy plug-in | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87394 | NOISE | 24 | 22 | 1 | 50 | 8.2 | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111957 | NOISE | 24 | 12 | 33 | 40 | 5.3 | none | none | unknown | sumit payment gateway for woocommerce | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-91267 | NOISE | 24 | 23 | 1 | 49 | 8.6 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83407 | NOISE | 24 | 23 | 1 | 49 | 8.6 | none | oracle corporation | oracle access manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101684 | NOISE | 24 | 11 | 33 | 40 | 8.3 | none | none | oracle corporation | oracle e-business suite integrated soa gateway | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-116068 | NOISE | 24 | 12 | 30 | 40 | 8.8 | none | none | dokploy | dokploy | 2026-10-25 | CISA SSVC: total technical impact | Apply the upstream patch commit b3cd3c5061b9e4f9a786dc4a048765f79bae2523 in the Dokploy repository, which adds the missing cross-organization ownership check in the application router. | |||
| CVE-2026-101473 | NOISE | 24 | 22 | 1 | 49 | 8.1 | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112330 | NOISE | 24 | 13 | 30 | 40 | 7.5 | 52.1 | none | none | gdatasoftwareag | motornet | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-3161 | NOISE | 24 | 0 | 55 | 40 | 5.9 | 10.4 | none | none | ibm | cloud pak system | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-113664 | NOISE | 24 | 15 | 25 | 40 | 5.3 | 41.5 | poc | poc_early | apostrophecms, @apostrophecms | apostrophe · import-export | 2026-10-20 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-101479 | NOISE | 24 | 23 | 1 | 50 | 8.6 | none | oracle corporation | oracle secure backup | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101834 | NOISE | 24 | 22 | 1 | 50 | 8.1 | none | oracle corporation | oracle shipping execution | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83426 | NOISE | 24 | 23 | 1 | 49 | 8.7 | none | oracle corporation | oracle access manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114382 | NOISE | 24 | 16 | 13 | 50 | 10.0 | 51.3 | none | totolink | ex200 | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101842 | NOISE | 24 | 24 | 0 | 49 | 8.8 | none | oracle corporation | strategic network optimization | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111749 | NOISE | 24 | 15 | 25 | 40 | 2.3 | 20.8 | none | none | aio-libs | aiohttp | 2026-10-19 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-92843 | NOISE | 24 | 15 | 25 | 40 | 8.7 | none | none | eclipse foundation | eclipse threadx – netx duo | 2026-10-20 | CISA SSVC: automatable | Upgrade NetX Duo to version 6.5.2.202603 or later; versions up to and including 6.5.1.202602 are affected. | |||
| CVE-2026-91212 | NOISE | 24 | 23 | 1 | 50 | 8.6 | none | oracle corporation | oracle identity manager connector | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91217 | NOISE | 24 | 23 | 1 | 50 | 8.6 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91313 | NOISE | 24 | 22 | 1 | 49 | 8.1 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91346 | NOISE | 24 | 22 | 1 | 50 | 8.2 | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111063 | NOISE | 24 | 15 | 25 | 40 | 6.3 | 11.9 | none | none | aio-libs | aiohttp | 2026-10-19 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-115513 | NOISE | 24 | 8 | 13 | 65 | 8.7 | none | opencats | opencats | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to OpenCATS 0.12.0 or later, which fixes the MRU rendering issue (commit f82e0ee). | ||||
| CVE-2026-113779 | NOISE | 24 | 7 | 33 | 50 | 8.8 | 34.1 | none | none | pfrest | pfsense-pkg-restapi | 2026-10-21 | CISA SSVC: total technical impact | Upgrade pfSense-pkg-RESTAPI to 2.9.0 or later, which removes the sub-administrative sync privilege and requires full admin (page-all) for the HA settings sync endpoint. | ||
| CVE-2026-103301 | NOISE | 24 | 12 | 33 | 40 | 5.3 | none | none | unknown | payment gateway for telcell | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-115497 | NOISE | 23 | 13 | 25 | 40 | 7.5 | 59.0 | none | none | codepeople | music store – wordpress ecommerce | 2026-10-23 | CISA SSVC: automatable | |||
| CVE-2026-107237 | NOISE | 23 | 7 | 13 | 65 | 8.2 | none | none | unknown | backup and staging by wp time capsule | 2026-10-21 | no exploitation evidence in any monitored source | Update Backup and Staging by WP Time Capsule to version 1.22.28 or later. | |||
| CVE-2026-114078 | NOISE | 23 | 12 | 1 | 65 | 8.1 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to Trigger.dev 4.5.6 or later; versions before 4.5.6 are affected. | ||||
| CVE-2026-114066 | NOISE | 23 | 12 | 1 | 65 | 8.1 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to trigger.dev 4.7.0 or later; versions before 4.7.0 are affected. | ||||
| CVE-2026-116011 | NOISE | 23 | 13 | 25 | 40 | 7.5 | 52.2 | none | none | crowcpp | crow | 2026-10-24 | CISA SSVC: automatable | |||
| CVE-2025-36061 | NOISE | 23 | 0 | 50 | 40 | 6.5 | 13.5 | none | none | ibm | storage ts4500 library | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-114489 | NOISE | 23 | 5 | 18 | 65 | 8.1 | 18.6 | none | progressive robot ltd | hmailserver | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to hMailServer 6.3.7, which refuses domain-alias creation, domain rename, internal relay hosts and the reaching rule actions to confined credentials over both REST and COM APIs. | |||
| CVE-2026-87305 | NOISE | 23 | 22 | 0 | 49 | 8.1 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115933 | NOISE | 23 | 6 | 13 | 65 | 9.9 | 16.1 | none | gitroomhq | postiz-app | 2026-10-24 | no exploitation evidence in any monitored source | Upgrade postiz-app to 2.25.3 or later, which contains the patch commit a5affe6. | |||
| CVE-2026-43851 | NOISE | 23 | 0 | 50 | 40 | 8.2 | 33.6 | none | none | advantech | adam-3600 | 2026-10-20 | no exploitation evidence in any monitored source | Update ADAM-3600 to version 2.8.5.0 or later; all versions prior to 2.8.5.0 are affected. | ||
| CVE-2026-91377 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | oracle corporation | siebel crm integration | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-4405 | NOISE | 23 | 0 | 50 | 40 | 4.0 | none | none | ibm | concert | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116171 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | siyuan-note | siyuan | 2026-10-25 | CISA SSVC: automatable | ||||
| CVE-2026-113704 | NOISE | 23 | 13 | 25 | 40 | 7.3 | none | none | a2aproject | a2a-rs | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-43840 | NOISE | 23 | 0 | 50 | 40 | 6.9 | 18.6 | none | none | advantech | adam-3600 | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-79880 | NOISE | 23 | 5 | 33 | 50 | 8.7 | 42.7 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79878 | NOISE | 23 | 4 | 33 | 50 | 8.8 | 57.0 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105299 | NOISE | 23 | 6 | 38 | 40 | 8.7 | 25.5 | none | none | cloudflare | https://github.com/cloudflare/pingora | 2026-10-20 | CISA SSVC: total technical impact | Upgrade to pingora 0.9.0 or later, which by default strips hop-by-hop and Connection-nominated headers and rejects requests nominating Host, X-Forwarded-* or pseudo-headers. | ||
| CVE-2026-105941 | NOISE | 23 | 10 | 30 | 40 | 8.1 | none | none | red hat | streams for apache kafka 3 | 2026-10-20 | CISA SSVC: total technical impact | No patch stated; restrict proxy pod egress via Kubernetes NetworkPolicy to legitimate Azure Key Vault endpoints on port 443 and alert on unwrap requests to unexpected vault hostnames. | |||
| CVE-2026-101460 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-101461 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-101463 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | oracle corporation | siebel crm end user | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-101640 | NOISE | 23 | 14 | 25 | 40 | 8.2 | none | none | oracle corporation | oracle marketing | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-101660 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-87800 | NOISE | 23 | 0 | 50 | 40 | 6.8 | none | none | ibm | cyber fraud | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91542 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | oracle corporation | oracle webcenter sites | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-91573 | NOISE | 23 | 14 | 25 | 40 | 8.2 | none | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-91625 | NOISE | 23 | 14 | 25 | 40 | 8.2 | none | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-94402 | NOISE | 23 | 0 | 50 | 40 | 6.1 | none | none | ibm | @carbon/charts-react · @carbon/charts-angular · @carbon/charts-vue +1 more | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101688 | NOISE | 23 | 10 | 33 | 40 | 8.6 | 34.8 | none | none | oracle corporation | oracle e-business suite integrated soa gateway | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-101690 | NOISE | 23 | 9 | 33 | 40 | 8.2 | 27.9 | none | none | oracle corporation | oracle e-business suite integrated soa gateway | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-114493 | NOISE | 23 | 10 | 30 | 40 | 8.6 | 30.8 | none | none | localai | localai | 2026-10-21 | CISA SSVC: automatable | Upgrade to a LocalAI release containing the fix from PR #12791, which addresses the SSRF guard bypass via HTTP redirects; versions 4.6.0 through 4.11.0 are affected. | ||
| CVE-2026-110353 | NOISE | 23 | 13 | 25 | 40 | 7.5 | 52.0 | none | none | haproxy | haproxy enterprise edition · kubernetes ingress controller enterprise | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2025-36069 | NOISE | 23 | 0 | 50 | 40 | 5.5 | 1.6 | none | none | ibm | storage ts4500 library | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-110354 | NOISE | 23 | 13 | 25 | 40 | 7.5 | 54.9 | none | none | haproxy, haproxy technologies | haproxy enterprise edition · haproxy kubernetes ingress controller · kubernetes ingress controller enterprise | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-113872 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | multer | multer | 2026-10-22 | CISA SSVC: automatable | ||||
| CVE-2026-115347 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | lepture | mistune | 2026-10-22 | CISA SSVC: automatable | ||||
| CVE-2026-115349 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | lepture | mistune | 2026-10-22 | CISA SSVC: automatable | ||||
| CVE-2025-36252 | NOISE | 23 | 0 | 50 | 40 | 6.3 | 4.1 | none | none | ibm | storage ts4500 library | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-104068 | NOISE | 23 | 8 | 25 | 50 | 7.2 | 51.1 | none | none | jetbackup | jetbackup | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-113788 | NOISE | 23 | 8 | 25 | 50 | 9.4 | 32.7 | none | none | uselagoon | lagoon | 2026-10-21 | CISA SSVC: total technical impact | Upgrade to Lagoon v2.33.2 or later (included in the lagoon/lagoon-core helm chart v1.62.2); alternatively disable the ssh service in Lagoon core as a workaround. | ||
| CVE-2026-53942 | NOISE | 23 | 9 | 25 | 50 | 9.9 | 25.3 | none | none | conda | infrastructure | 2026-10-23 | CISA SSVC: total technical impact | Update to commit 9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55 or later, which patches the workflow. | ||
| CVE-2026-53920 | NOISE | 23 | 10 | 33 | 40 | 8.7 | 33.4 | none | none | openwrt | odhcpd | 2026-10-23 | CISA SSVC: automatable | Upgrade odhcpd to version 25.12.3 or later, which patches the DHCPv6 IA parser bounds check. | ||
| CVE-2026-105937 | NOISE | 23 | 6 | 30 | 50 | 8.7 | 15.4 | none | none | apache software foundation | apache pulsar | 2026-10-21 | CISA SSVC: total technical impact | Upgrade to Apache Pulsar 4.0.14 or later (4.0.x) or 4.2.5 or later (4.1.x/4.2.x); shadow topics are then disabled by default via enableShadowTopics=false. | ||
| CVE-2026-116167 | NOISE | 23 | 8 | 25 | 50 | 6.8 | none | none | siyuan-note | siyuan | 2026-10-25 | CISA SSVC: total technical impact | ||||
| CVE-2026-3303 | NOISE | 23 | 0 | 50 | 40 | 3.7 | 16.1 | none | none | ibm | concert | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-90797 | NOISE | 23 | 13 | 25 | 40 | 7.7 | none | none | apache software foundation | apache couchdb | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-1501 | NOISE | 23 | 0 | 50 | 40 | 3.7 | none | none | ibm | concert | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-1510 | NOISE | 23 | 0 | 50 | 40 | 4.7 | none | none | ibm | concert | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116183 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | thorsten | phpmyfaq | 2026-10-25 | CISA SSVC: automatable | ||||
| CVE-2026-10574 | NOISE | 23 | 7 | 48 | 30 | 8.8 | 37.7 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | CISA SSVC: total technical impact | Upgrade to IBM MQ Operator v4.1.0 or later; versions 3.2.0 through 3.2.29 and 3.3.0 up to (but not including) 3.4.0 are affected. | ||
| CVE-2026-112775 | NOISE | 23 | 8 | 25 | 50 | 7.5 | 22.7 | none | none | craftcms | cms | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-116179 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | vllm-project | vllm | 2026-10-25 | CISA SSVC: automatable | ||||
| CVE-2026-81812 | NOISE | 23 | 8 | 25 | 50 | 6.4 | none | none | unknown | elementor website builder | 2026-10-21 | CISA SSVC: total technical impact | ||||
| CVE-2026-93639 | NOISE | 23 | 5 | 33 | 50 | 8.7 | 31.2 | none | zimbra | zimbra collaboration suite | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101687 | NOISE | 23 | 9 | 33 | 40 | 7.5 | none | none | oracle corporation | oracle e-business suite integrated soa gateway | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-80344 | NOISE | 23 | 14 | 25 | 40 | 8.2 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: automatable | Upgrade to Apache Camel 4.23.0; 4.18.x LTS users to 4.18.5 or later and 4.22.x LTS users to 4.22.1 or later. | |||
| CVE-2026-4413 | NOISE | 23 | 0 | 50 | 40 | 6.1 | none | none | ibm | concert | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-6930 | NOISE | 23 | 0 | 50 | 40 | 3.7 | none | none | ibm | concert | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113397 | NOISE | 23 | 13 | 25 | 40 | 7.4 | poc | poc_early | draytek | vigor2960 | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-113392 | NOISE | 23 | 13 | 25 | 40 | 7.4 | poc | poc_early | draytek | vigor2960 | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-113395 | NOISE | 23 | 13 | 25 | 40 | 7.4 | poc | poc_early | draytek | vigor2960 | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-114069 | NOISE | 23 | 12 | 1 | 65 | 8.1 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade Trigger.dev to 4.6.0 or later, which is listed as unaffected. | ||||
| CVE-2026-114068 | NOISE | 23 | 13 | 1 | 65 | 8.3 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade Trigger.dev to 4.6.0 or later; versions before 4.6.0 are affected. | ||||
| CVE-2026-112380 | NOISE | 23 | 6 | 13 | 65 | 9.9 | 33.8 | none | amazon | kiro crew | 2026-10-20 | no exploitation evidence in any monitored source | Upgrade to Kiro Crew 0.7.2 or later; versions 0.4.0 through 0.7.1 are affected. | |||
| CVE-2026-113396 | NOISE | 23 | 13 | 25 | 40 | 7.4 | poc | poc_early | draytek | vigor2960 | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-79864 | NOISE | 23 | 5 | 33 | 49 | 9.6 | 67.0 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-14933 | NOISE | 23 | 11 | 30 | 40 | 8.6 | none | none | unblu inc. | unblu spark | 2026-10-20 | CISA SSVC: total technical impact | Upgrade to Unblu Spark 8.39.3 or later, or 7.57.9 or later; hotfixes 8.35.2-hotfix.0, 8.37.2-hotfix.2 and 8.38.2-hotfix.0 also contain the fix. Unblu Cloud is already patched. | |||
| CVE-2026-43854 | NOISE | 23 | 0 | 50 | 40 | 6.3 | 3.5 | none | none | advantech | adam-3600 | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-85251 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-91608 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | oracle corporation | oracle bi publisher | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-91552 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | oracle corporation | oracle webcenter sites | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-43835 | NOISE | 23 | 6 | 50 | 30 | 8.6 | 15.5 | none | none | advantech | adam-3600 | 2026-10-20 | CISA SSVC: total technical impact | Update ADAM-3600 firmware to version 2.8.5.0 or later; versions prior to 2.8.5.0 are affected. | ||
| CVE-2026-115419 | NOISE | 23 | 5 | 18 | 65 | 8.1 | 36.6 | none | aws | strands-agents/sdk | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to strands-agents 1.43.0 or later (Python) or @strands-agents/sdk 1.5.0 or later (TypeScript). | |||
| CVE-2026-43853 | NOISE | 23 | 0 | 50 | 40 | 8.2 | 35.5 | none | none | advantech | adam-3600 | 2026-10-20 | no exploitation evidence in any monitored source | Update ADAM-3600 firmware to version 2.8.5.0 or later; all versions prior to 2.8.5.0 are affected. | ||
| CVE-2026-92449 | NOISE | 23 | 8 | 25 | 50 | 6.8 | none | none | eclipse foundation | eclipse threadx – guix | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-113619 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | eclipse foundation | eclipse iofog | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-113709 | NOISE | 23 | 14 | 25 | 40 | 9.9 | none | none | argoproj | argo-cd | 2026-10-20 | CISA SSVC: total technical impact | Upgrade to Argo CD 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 or later. | |||
| CVE-2026-113708 | NOISE | 23 | 14 | 25 | 40 | 9.9 | none | none | argoproj | argo-cd | 2026-10-20 | CISA SSVC: total technical impact | Upgrade to Argo CD 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 or later; replacing Kustomize alone does not fix the missing option separator. | |||
| CVE-2026-91622 | NOISE | 23 | 13 | 25 | 40 | 9.3 | none | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-43847 | NOISE | 23 | 0 | 50 | 40 | 8.2 | 12.8 | none | none | advantech | adam-3600 | 2026-10-20 | no exploitation evidence in any monitored source | Update ADAM-3600 to version 2.8.5.0 or later; all versions prior to 2.8.5.0 are affected. | ||
| CVE-2026-115931 | NOISE | 23 | 6 | 13 | 65 | 9.9 | 41.4 | none | gitroomhq | postiz-app | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade postiz-app to 2.25.2 or later; versions from 2.23.0 before 2.25.2 are affected. | |||
| CVE-2026-97313 | NOISE | 23 | 8 | 25 | 50 | 7.5 | 37.9 | none | none | isc | bind 9 | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-12148 | NOISE | 23 | 7 | 48 | 30 | 8.8 | 33.4 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | CISA SSVC: total technical impact | Upgrade to IBM MQ Operator v4.1.0 or later, which addresses the issues in this bulletin. | ||
| CVE-2026-9825 | NOISE | 23 | 0 | 50 | 40 | 3.7 | none | none | ibm | cyberfraud | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114085 | NOISE | 23 | 10 | 30 | 40 | 7.9 | none | none | triggerdotdev | trigger.dev | 2026-10-21 | CISA SSVC: total technical impact | ||||
| CVE-2026-112104 | NOISE | 23 | 13 | 25 | 40 | 7.3 | none | none | eremef | bandcamp-player | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-115328 | NOISE | 23 | 9 | 8 | 65 | 8.8 | none | riclolsen | json-scada | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to JSON-SCADA 0.65-alpha or later; the fix is in commit 60b65bcd42d6ee21aa8587580ec778c3bb9b4755 and release V0.65-alpha. | ||||
| CVE-2026-16487 | NOISE | 23 | 10 | 33 | 38 | 8.1 | 6.3 | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 8 · red hat enterprise linux 9 +2 more | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112146 | NOISE | 23 | 13 | 25 | 40 | 7.4 | poc | poc_early | d-link | e15 · m32 · r15 +1 more | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-115482 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | litespeedtech | lsquic | 2026-10-22 | CISA SSVC: automatable | ||||
| CVE-2026-43852 | NOISE | 23 | 0 | 50 | 40 | 8.2 | 33.6 | none | none | advantech | adam-3600 | 2026-10-20 | no exploitation evidence in any monitored source | Update ADAM-3600 to version 2.8.5.0 or later; versions prior to 2.8.5.0 are affected. | ||
| CVE-2026-110887 | NOISE | 23 | 14 | 25 | 40 | 9.9 | none | none | hivepress | hivepress | 2026-10-19 | CISA SSVC: total technical impact | Update the HivePress WordPress plugin to version 1.8.0 or later. | |||
| CVE-2026-111406 | NOISE | 23 | 14 | 25 | 40 | 9.9 | none | none | pt norther lights production | mapsvg | 2026-10-19 | CISA SSVC: total technical impact | Update the WordPress MapSVG plugin to at least version 8.16.2. | |||
| CVE-2026-10572 | NOISE | 23 | 7 | 48 | 30 | 8.8 | 38.6 | none | none | ibm | mq_operator 3.3.0, 3.4.0, 3.4.1, 3.5.0 · supplied_mq_advanced_container_images 9.4.1.0, 9.4.1.1, 9.4.2.0, 9.4.2.1 · mq operator | 2026-10-19 | CISA SSVC: total technical impact | Upgrade to IBM MQ Operator v4.1.0 or later; affected versions are 3.2.0 through 3.2.29 and 3.3.0 up to (but not including) 3.4.0. | ||
| CVE-2026-112366 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | micromatch | picomatch | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-111045 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | anshupriyan | cli-bridge | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-87417 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | oracle corporation | oracle solaris | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-112309 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | airjp73 | @rvf/set-get | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-113717 | NOISE | 22 | 7 | 25 | 50 | 2.3 | 21.2 | poc | poc_early | pypa | virtualenv | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-91186 | NOISE | 22 | 11 | 25 | 40 | 8.4 | none | none | eclipse foundation | eclipse threadx – guix | 2026-10-20 | CISA SSVC: total technical impact | Upgrade to Eclipse ThreadX GUIX 6.5.2.202603 or later; versions up to and including 6.5.1.202602a are affected. | |||
| CVE-2026-16477 | NOISE | 22 | 11 | 25 | 40 | 8.4 | none | none | mtw | cleanshot x | 2026-10-22 | CISA SSVC: total technical impact | Update CleanShot X to 4.5.2, 4.6.3, 4.7.8 or 4.8.10 (or later) depending on your release line. | |||
| CVE-2026-112138 | NOISE | 22 | 12 | 25 | 40 | 4.7 | poc | poc_early | diem-project | diem | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112251 | NOISE | 22 | 12 | 25 | 40 | 4.3 | poc | poc_early | antoinersx | clawhost | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-85315 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2025-60482 | NOISE | 22 | 12 | 25 | 40 | 5.5 | poc | poc_early | n/a | n/a | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-9827 | NOISE | 22 | 12 | 25 | 40 | 9.1 | 50.0 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-113715 | NOISE | 22 | 7 | 25 | 50 | 2.0 | 15.3 | poc | poc_early | pypa | virtualenv | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-112860 | NOISE | 22 | 12 | 25 | 40 | 9.3 | 25.1 | none | none | xnau webdesign | participants database | 2026-10-23 | CISA SSVC: automatable | |||
| CVE-2026-115546 | NOISE | 22 | 5 | 38 | 40 | 8.1 | 36.1 | none | none | okta | okta access gateway | 2026-10-23 | CISA SSVC: total technical impact | Upgrade the Okta Access Gateway appliance to version 2026.10.2 or later. | ||
| CVE-2026-115496 | NOISE | 22 | 12 | 25 | 40 | 6.9 | none | none | knime | knime business hub | 2026-10-22 | CISA SSVC: automatable | ||||
| CVE-2026-109433 | NOISE | 22 | 7 | 25 | 50 | 6.5 | 37.4 | poc | poc_early | camunda | camunda 7 | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-95109 | NOISE | 22 | 11 | 25 | 40 | 8.5 | none | none | eclipse foundation | eclipse threadx | 2026-10-20 | CISA SSVC: total technical impact | Upgrade to Eclipse ThreadX 6.5.2.202603 or later; versions 6.1 through 6.5.1.202602a are affected. | |||
| CVE-2026-91610 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | oracle corporation | oracle rest data services | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-116063 | NOISE | 22 | 12 | 25 | 40 | 4.7 | poc | poc_early | n/a | dedecms | 2026-10-25 | CISA SSVC: public proof of concept | ||||
| CVE-2026-95718 | NOISE | 22 | 7 | 25 | 50 | 5.3 | 31.4 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-115325 | NOISE | 22 | 6 | 25 | 50 | 8.3 | 29.8 | none | none | gravitl | netmaker | 2026-10-22 | CISA SSVC: total technical impact | Apply the patch commit 332d8b9bab030ee65e78b9141259e4e0e80ac4b0 (PR #4153); no fixed release version is named, so upgrade past 1.7.0 once available. | ||
| CVE-2026-115331 | NOISE | 22 | 9 | 18 | 50 | 8.8 | none | uselotus | lotus | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115332 | NOISE | 22 | 9 | 18 | 50 | 8.8 | none | uselotus | lotus | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115334 | NOISE | 22 | 0 | 38 | 50 | 6.8 | none | uselotus | lotus | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-97635 | NOISE | 22 | 5 | 13 | 65 | 8.1 | 17.6 | none | agent zero | agent zero | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade Agent Zero to version 1.15 or later, which is listed as unaffected. | |||
| CVE-2026-103311 | NOISE | 22 | 7 | 33 | 40 | 5.3 | 1.4 | none | none | unknown | coinbase commerce payment gateway for woocommerce | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-115932 | NOISE | 22 | 5 | 13 | 65 | 9.6 | 36.7 | none | gitroomhq | postiz-app | 2026-10-24 | no exploitation evidence in any monitored source | Upgrade postiz-app to 2.25.3 or later; affected versions are 2.23.0 up to (but not including) 2.25.3. | |||
| CVE-2026-105945 | NOISE | 22 | 4 | 30 | 50 | 7.7 | 42.1 | none | none | apache software foundation | apache pulsar | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-108358 | NOISE | 22 | 11 | 25 | 40 | 8.8 | 41.3 | none | none | phpoffice | phpspreadsheet | 2026-10-22 | CISA SSVC: automatable | Upgrade to PhpSpreadsheet 1.30.7, 2.1.19, 2.4.8, 3.10.8, or 5.10.0 or later, depending on your release line. | ||
| CVE-2026-112946 | NOISE | 22 | 12 | 25 | 40 | 6.3 | poc | poc_early | vitejs | vite-plus | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112958 | NOISE | 22 | 12 | 25 | 40 | 5.4 | poc | poc_early | apostrophecms | apostrophe | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-113660 | NOISE | 22 | 12 | 25 | 40 | 4.3 | poc | poc_early | apostrophecms | apostrophe | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-76788 | NOISE | 22 | 7 | 33 | 40 | 8.8 | 9.8 | none | none | zephyrproject | zephyr | 2026-10-19 | CISA SSVC: total technical impact | Apply the upstream Zephyr patch (commit f10d55f47c6970e95d3a7c6ba08e6adec3c79acd, per advisory GHSA-fgg7-h8p9-9q3w), which adds an OSDP_EVENT_MAX_DATALEN bound to the REPLY_KEYPPAD and REPLY_RAW handlers. | ||
| CVE-2026-113655 | NOISE | 22 | 12 | 25 | 40 | 4.3 | poc | poc_early | apostrophecms | apostrophe | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112951 | NOISE | 22 | 12 | 25 | 40 | 5.4 | poc | poc_early | apostrophecms | apostrophe | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-113651 | NOISE | 22 | 12 | 25 | 40 | 3.3 | poc | poc_early | apostrophecms | apostrophe · uploadfs | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-113666 | NOISE | 22 | 12 | 25 | 40 | 7.1 | poc | poc_early | apostrophecms, @apostrophecms | apostrophe · db-connect | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112781 | NOISE | 22 | 7 | 25 | 50 | 6.5 | 15.1 | none | none | getgrav | grav | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-79986 | NOISE | 22 | 21 | 30 | 15 | 7.4 | poc | poc_early | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | ||||
| CVE-2026-112773 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | craftcms | cms | 2026-10-19 | CISA SSVC: total technical impact | Upgrade to Craft CMS 5.11.0 or later; versions from 5.0.0 before 5.11.0 are affected. | |||
| CVE-2026-112768 | NOISE | 22 | 12 | 25 | 40 | 6.9 | none | none | parse-community | parse-server | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-112284 | NOISE | 22 | 12 | 25 | 40 | 3.3 | poc | poc_early | xqq | libaribcaption | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112282 | NOISE | 22 | 12 | 25 | 40 | 5.5 | poc | poc_early | videolan | libbluray | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112283 | NOISE | 22 | 12 | 25 | 40 | 5.5 | poc | poc_early | videolan | libbluray | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-111065 | NOISE | 22 | 12 | 25 | 40 | 6.9 | none | none | aio-libs | aiohttp | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-85257 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-112266 | NOISE | 22 | 12 | 25 | 40 | 5.9 | poc | poc_early | sgl-project | sglang | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-111831 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | wp manageninja llc | fluentform | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-112107 | NOISE | 22 | 12 | 25 | 40 | 6.3 | poc | poc_early | ztxz16 | fastllm | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2025-71436 | NOISE | 22 | 12 | 25 | 40 | 7.1 | poc | poc_early | librdf | raptor rdf syntax library | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-87420 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | oracle corporation | oracle service bus | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-113612 | NOISE | 22 | 12 | 25 | 40 | 5.4 | poc | poc_early | codewithcj | sparkyfitness | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-10131 | NOISE | 22 | 12 | 25 | 40 | 9.1 | 72.0 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-103038 | NOISE | 22 | 11 | 25 | 40 | 8.6 | 88.8 | none | none | streamsoft | pingtools network utilities | 2026-10-19 | CISA SSVC: total technical impact | Upgrade to the first fixed release when available; the vendor solution also requires replacing sh -c with an argument-list process API and validating Host as a DNS name or IP address. | ||
| CVE-2026-113741 | NOISE | 22 | 12 | 25 | 40 | 4.3 | poc | poc_early | itsourcecode | online cake ordering system | 2026-10-21 | CISA SSVC: public proof of concept | ||||
| CVE-2026-113740 | NOISE | 22 | 12 | 25 | 40 | 6.3 | poc | poc_early | itsourcecode | online cake ordering system | 2026-10-21 | CISA SSVC: public proof of concept | ||||
| CVE-2026-10138 | NOISE | 22 | 12 | 25 | 40 | 9.1 | 73.1 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-114039 | NOISE | 22 | 12 | 25 | 40 | 6.3 | poc | poc_early | projectworlds | advanced library management system | 2026-10-21 | CISA SSVC: public proof of concept | ||||
| CVE-2026-105992 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | unknown | ettrick escape room booking | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-108073 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | unknown | surecart | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-115330 | NOISE | 22 | 9 | 18 | 50 | 8.8 | none | uselotus | lotus | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113735 | NOISE | 22 | 12 | 25 | 40 | 3.7 | poc | poc_early | d-link | dcs-6501lh | 2026-10-21 | CISA SSVC: public proof of concept | ||||
| CVE-2026-111596 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | unknown | kliken: ads + pixel for meta | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-101686 | NOISE | 22 | 7 | 33 | 40 | 8.8 | 40.0 | none | none | oracle corporation | oracle e-business suite integrated soa gateway | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-111955 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | unknown | wholesalex | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-15261 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | unknown | ti woocommerce wishlist | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-92999 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | unknown | click n chat (chat widget integration) | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-107447 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | unknown | contest gallery | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-108062 | NOISE | 22 | 12 | 25 | 40 | 6.9 | none | none | eclipse foundation | eclipse csi – pia | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-95704 | NOISE | 22 | 8 | 33 | 40 | 7.2 | 51.1 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-91527 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | oracle corporation | oracle zfs storage appliance kit | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-112834 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | castos | seriously simple podcasting | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-42023 | NOISE | 22 | 7 | 25 | 50 | 9.1 | 43.4 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-112936 | NOISE | 22 | 12 | 25 | 40 | 6.1 | poc | poc_early | tox-dev | filelock | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-9814 | NOISE | 22 | 12 | 25 | 40 | 9.1 | 75.6 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101685 | NOISE | 22 | 7 | 33 | 40 | 8.8 | 40.0 | none | none | oracle corporation | oracle e-business suite integrated soa gateway | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-113656 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | apostrophecms, @apostrophecms | apostrophe · form | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-91493 | NOISE | 22 | 8 | 33 | 40 | 7.5 | 21.0 | none | none | oracle corporation | oracle identity manager connector | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-54630 | NOISE | 22 | 5 | 13 | 65 | 9.6 | 14.1 | none | part-db | part-db-server | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to Part-DB-server 2.12.1 or later, which patches the phar extension bypass in the attachment upload handler. | |||
| CVE-2026-114191 | NOISE | 22 | 8 | 33 | 40 | 7.5 | 26.7 | none | none | knit pay | upi qr code payment gateway for woocommerce | 2026-10-24 | CISA SSVC: automatable | |||
| CVE-2026-111976 | NOISE | 22 | 7 | 25 | 50 | 5.3 | 3.3 | none | none | unknown | givewp | 2026-10-25 | CISA SSVC: automatable | |||
| CVE-2026-79882 | NOISE | 22 | 3 | 33 | 49 | 8.3 | 51.9 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112271 | NOISE | 22 | 12 | 25 | 40 | 5.5 | poc | poc_early | emersion | libdisplay-info | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112195 | NOISE | 22 | 12 | 25 | 40 | 4.7 | poc | poc_early | n/a | fusionpbx | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112140 | NOISE | 22 | 12 | 25 | 40 | 6.3 | poc | poc_early | llsourcell | doctor-dignity | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-116072 | NOISE | 22 | 12 | 25 | 40 | 5.4 | none | none | docile-alligator | infinity for reddit | 2026-10-25 | CISA SSVC: automatable | ||||
| CVE-2026-116154 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | imagemagick | imagemagick | 2026-10-25 | CISA SSVC: automatable | ||||
| CVE-2026-116155 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | imagemagick | imagemagick | 2026-10-25 | CISA SSVC: automatable | ||||
| CVE-2026-116203 | NOISE | 22 | 12 | 25 | 40 | 6.1 | none | none | yeswiki | yeswiki | 2026-10-25 | CISA SSVC: automatable | ||||
| CVE-2026-116096 | NOISE | 22 | 12 | 25 | 40 | 5.3 | poc | poc_early | ggml-org | llama.cpp | 2026-10-25 | CISA SSVC: public proof of concept | ||||
| CVE-2026-114108 | NOISE | 22 | 11 | 0 | 65 | 9.8 | 28.2 | none | hkuds | vibe-trading | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade Vibe-Trading to 0.1.7 or later; versions 0.1.0 through 0.1.6 are affected. | |||
| CVE-2026-113611 | NOISE | 22 | 7 | 25 | 50 | 4.9 | 44.8 | poc | poc_early | outline | outline | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-107789 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | unknown | smartyparcel | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-112363 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | unclecode | crawl4ai | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-105256 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | unknown | latepoint | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-91554 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | oracle corporation | oracle bi publisher | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-42024 | NOISE | 22 | 7 | 25 | 50 | 9.1 | 43.4 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-35499 | NOISE | 22 | 12 | 25 | 40 | 9.1 | 69.9 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91532 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | oracle corporation | oracle applications manager | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-112272 | NOISE | 22 | 12 | 25 | 40 | 5.5 | poc | poc_early | emersion | libdisplay-info | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112289 | NOISE | 22 | 12 | 25 | 40 | 5.4 | poc | poc_early | koalixswitzerland | koalixcrm | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-106014 | NOISE | 22 | 7 | 33 | 40 | 5.3 | 3.5 | none | none | unknown | gateway for vantiv on wc | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-111883 | NOISE | 22 | 12 | 25 | 40 | 5.4 | poc | poc_early | locustio | locust | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-85254 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-85249 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-112291 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | flarum | extension manager | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-101810 | NOISE | 22 | 8 | 33 | 40 | 7.5 | 37.2 | none | none | oracle corporation | mysql router | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-116009 | NOISE | 22 | 5 | 13 | 65 | 8.8 | 36.4 | none | owen2345 | camaleon-cms | 2026-10-24 | no exploitation evidence in any monitored source | Upgrade Camaleon CMS to 2.9.3 or later, which contains the path traversal fix. | |||
| CVE-2026-85314 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-112829 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | arraytics | booktics | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-53918 | NOISE | 22 | 0 | 21 | 65 | 8.8 | 42.6 | none | openwrt | odhcpd | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade odhcpd to version 25.12 or later, which patches the DHCPv6 IA lease-pointer use-after-free. | |||
| CVE-2026-112067 | NOISE | 22 | 7 | 25 | 50 | 6.9 | 33.4 | none | none | typo3 | extension "accessible form captcha" | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-105810 | NOISE | 22 | 6 | 25 | 50 | 8.5 | 9.3 | none | none | tp-link systems inc. | tapo c320ws v2 | 2026-10-19 | CISA SSVC: total technical impact | Update Tapo C320WS v2 firmware to 1.6.6 Build 260917 Rel.81089n or later, per TP-Link’s firmware release notes. | ||
| CVE-2026-101379 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | oracle corporation | oracle rest data services | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-101466 | NOISE | 22 | 8 | 33 | 40 | 7.2 | none | none | oracle corporation | oracle edi gateway | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101631 | NOISE | 22 | 8 | 33 | 40 | 6.8 | none | none | oracle corporation | mysql router | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101648 | NOISE | 22 | 11 | 25 | 40 | 8.4 | none | none | oracle corporation | oracle partner management | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-83379 | NOISE | 22 | 11 | 25 | 40 | 8.7 | none | none | oracle corporation | oracle weblogic server proxy plug-in | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-87408 | NOISE | 22 | 11 | 25 | 40 | 8.7 | none | none | oracle corporation | oracle applications framework | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-87419 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | oracle corporation | oracle service bus | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-113378 | NOISE | 22 | 12 | 25 | 40 | 5.3 | 53.6 | poc | poc_early | mcollina | mcp-ripgrep | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-91520 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91521 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-113385 | NOISE | 22 | 12 | 25 | 40 | 5.3 | poc | poc_early | leedroid labs | shortcutter 2 app | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-91535 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91550 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-113505 | NOISE | 22 | 12 | 25 | 40 | 4.3 | poc | poc_early | n/a | aapanel | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-91563 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | oracle corporation | oracle olap | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91579 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | oracle corporation | oracle bi publisher | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-113677 | NOISE | 22 | 12 | 25 | 40 | 5.4 | poc | poc_early | froxlor | froxlor | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-113643 | NOISE | 22 | 12 | 25 | 40 | 4.3 | poc | poc_early | n/a | espocrm | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-113676 | NOISE | 22 | 12 | 25 | 40 | 4.3 | poc | poc_early | froxlor | froxlor | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112159 | NOISE | 22 | 12 | 25 | 40 | 5.5 | 58.0 | poc | poc_early | n/a | jumpserver | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-54668 | NOISE | 22 | 5 | 13 | 65 | 8.7 | 23.0 | none | kitodo | kitodo-production | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to Kitodo.Production 3.9.2 or later, which patches the insecure XML parsing helpers. | |||
| CVE-2026-91597 | NOISE | 22 | 11 | 25 | 40 | 8.3 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-42021 | NOISE | 22 | 7 | 25 | 50 | 9.1 | 40.9 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-42022 | NOISE | 22 | 7 | 25 | 50 | 9.1 | 40.9 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-10135 | NOISE | 22 | 12 | 25 | 40 | 9.1 | 72.0 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-112277 | NOISE | 22 | 12 | 25 | 40 | 6.5 | poc | poc_early | rdesktop | rdesktop | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112276 | NOISE | 22 | 12 | 25 | 40 | 6.1 | poc | poc_early | netpbm | netpbm | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112274 | NOISE | 22 | 12 | 25 | 40 | 3.7 | poc | poc_early | libtins | libtins | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-85246 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-112108 | NOISE | 22 | 12 | 25 | 40 | 6.3 | poc | poc_early | ztxz16 | fastllm | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-111056 | NOISE | 22 | 12 | 25 | 40 | 6.9 | none | none | fossbilling | fossbilling | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-111053 | NOISE | 22 | 12 | 25 | 40 | 6.9 | none | none | fossbilling | fossbilling | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-111408 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | expresstech | quiz and survey master | 2026-10-19 | CISA SSVC: total technical impact | Update the Quiz And Survey Master plugin to version 11.2.8 or later. | |||
| CVE-2026-111061 | NOISE | 22 | 12 | 25 | 40 | 4.3 | poc | poc_early | eugeny | russh | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-111839 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | videowhisper.com | broadcast live video | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-112269 | NOISE | 22 | 12 | 25 | 40 | 6.5 | poc | poc_early | sgl-project | sglang | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112157 | NOISE | 22 | 12 | 25 | 40 | 3.1 | poc | poc_early | memtensor | memmy-agent | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112279 | NOISE | 22 | 12 | 25 | 40 | 6.5 | poc | poc_early | rdesktop | rdesktop | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112281 | NOISE | 22 | 12 | 25 | 40 | 6.1 | poc | poc_early | nkoriyama | aribb24 | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112824 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | magepeople inc. | bus ticket booking with seat reservation | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-113393 | NOISE | 22 | 12 | 25 | 40 | 6.3 | poc | poc_early | draytek | vigor2960 | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112836 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | e4jvikwp | vikrentcar | 2026-10-20 | CISA SSVC: total technical impact | Update the VikRentCar WordPress plugin to version 1.4.9 or later. | |||
| CVE-2026-112906 | NOISE | 22 | 12 | 25 | 40 | 4.7 | poc | poc_early | tox-dev | filelock | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-85683 | NOISE | 22 | 12 | 25 | 40 | 8.8 | none | none | unknown | jane menu | 2026-10-21 | CISA SSVC: total technical impact | Update the Jane Menu WordPress plugin to version 1.5.1 or later. | |||
| CVE-2026-112915 | NOISE | 22 | 12 | 25 | 40 | 5.5 | poc | poc_early | tox-dev | filelock | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-112939 | NOISE | 22 | 12 | 25 | 40 | 4.7 | poc | poc_early | tox-dev | filelock | 2026-10-20 | CISA SSVC: public proof of concept | ||||
| CVE-2026-113668 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | apostrophecms | apostrophe | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-113653 | NOISE | 22 | 12 | 25 | 40 | 6.9 | none | none | apostrophecms | apostrophe | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-101138 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | unknown | cmp – coming soon & maintenance | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-87838 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | unknown | wava payment plugin | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-87837 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | unknown | wava payment plugin | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-100145 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | unknown | synchrony financing | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-91609 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | oracle corporation | oracle rest data services | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-114040 | NOISE | 22 | 12 | 25 | 40 | 3.5 | poc | poc_early | dt42 | berrynet | 2026-10-21 | CISA SSVC: public proof of concept | ||||
| CVE-2026-114095 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | jelmer | dulwich | 2026-10-21 | CISA SSVC: automatable | ||||
| CVE-2026-91364 | NOISE | 22 | 8 | 30 | 40 | 6.8 | none | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-111845 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | yith | yith woocommerce product bundles | 2026-10-19 | CISA SSVC: automatable | ||||
| CVE-2026-101446 | NOISE | 22 | 16 | 6 | 50 | 9.9 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-94228 | NOISE | 22 | 7 | 25 | 50 | 5.3 | 6.7 | none | none | unknown | truebooker | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-86791 | NOISE | 22 | 7 | 33 | 40 | 5.3 | 1.4 | none | none | unknown | ipospays payment gateway for woocommerce | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-56832 | NOISE | 22 | 5 | 13 | 65 | 8.8 | 3.9 | none | mervinpraison | praisonai | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade PraisonAI to version 4.6.59 or later, which patches the Discord approval cross-talk issue. | |||
| CVE-2026-56835 | NOISE | 22 | 5 | 13 | 65 | 8.3 | 11.8 | none | mervinpraison | praisonai | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade PraisonAI to version 4.6.59 or later, which patches the app_mention handler. | |||
| CVE-2026-114621 | NOISE | 22 | 5 | 13 | 65 | 8.8 | 28.5 | none | baserproject | basercms | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to baserCMS 5.3.2 or later (5.3.x branch) or 5.4.2 or later (5.4.x branch). | |||
| CVE-2026-79977 | NOISE | 22 | 10 | 21 | 45 | 8.2 | 6.0 | none | zephyrproject | zephyr | 2026-10-23 | no exploitation evidence in any monitored source | Apply the upstream Zephyr patch (commit cbaaf3e9dbe08be21f01bd23142e1ffe91fd4db6, per advisory GHSA-w8h4-r8m3-rf5j), which stops learning the endpoint from unauthenticated messages; affected versions are 4.4.0 through 4. | |||
| CVE-2026-115935 | NOISE | 22 | 5 | 13 | 65 | 8.8 | 30.5 | none | craftcms | cms | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to Craft CMS 5.11.2 or later (5.x), or 4.18.9 or later (4.x). | |||
| CVE-2026-116067 | NOISE | 22 | 12 | 0 | 65 | 8.2 | none | ananthakumaran | paisa | 2026-10-25 | no exploitation evidence in any monitored source | Upgrade to Paisa 0.7.8 or later, which fixes the path traversal in the editor and sheet handlers. | ||||
| CVE-2026-108357 | NOISE | 22 | 11 | 25 | 40 | 8.8 | 29.2 | none | none | phpoffice | phpspreadsheet | 2026-10-22 | CISA SSVC: automatable | Upgrade to PhpSpreadsheet 3.10.8 or later (3.x) or 5.10.0 or later (5.x). | ||
| CVE-2026-112100 | NOISE | 22 | 12 | 25 | 40 | 5.5 | poc | poc_early | n/a | deeppavlov | 2026-10-19 | CISA SSVC: public proof of concept | ||||
| CVE-2026-114094 | NOISE | 22 | 10 | 1 | 65 | 8.8 | none | jelmer | dulwich | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to Dulwich 1.2.9 or later, which validates DOS drive-letter prefixes in tree paths. | ||||
| CVE-2026-94192 | NOISE | 22 | 11 | 25 | 40 | 8.5 | none | none | eclipse foundation | eclipse threadx | 2026-10-20 | CISA SSVC: total technical impact | Upgrade to Eclipse ThreadX 6.5.2.202603 or later; versions 6.0.1 through 6.5.1.202602a are affected. | |||
| CVE-2026-114658 | NOISE | 22 | 5 | 13 | 65 | 8.8 | 17.3 | none | getgrav | grav-plugin-login | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade the Grav Login plugin to 3.9.13 or later; versions from 3.6.0 before 3.9.13 are affected. | |||
| CVE-2026-112043 | NOISE | 22 | 7 | 33 | 40 | 6.3 | 21.0 | poc | poc_early | calcom | cal.com · cal.diy | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-9660 | NOISE | 22 | 7 | 33 | 40 | 9.1 | 43.4 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-112842 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | cozmoslabs | paid member subscriptions | 2026-10-22 | CISA SSVC: automatable | ||||
| CVE-2026-112030 | NOISE | 22 | 7 | 25 | 50 | 6.3 | 10.5 | poc | poc_early | diem-project | diem | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-101758 | NOISE | 21 | 9 | 25 | 40 | 8.2 | 26.1 | none | none | oracle corporation | oracle communications billing and revenue management | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-87402 | NOISE | 21 | 9 | 25 | 40 | 7.3 | none | none | oracle corporation | applications dba | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-111074 | NOISE | 21 | 10 | 25 | 40 | 8.7 | 35.4 | none | none | eclipse foundation | eclipse openj9 | 2026-10-21 | CISA SSVC: automatable | Upgrade Eclipse OpenJ9 to 0.63.0 or later; versions prior to 0.63.0 are affected. | ||
| CVE-2026-113736 | NOISE | 21 | 16 | 1 | 50 | 9.8 | none | d-link | dhp-w610av | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-75779 | NOISE | 21 | 11 | 33 | 30 | 8.6 | 68.1 | none | none | asus | router | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-111805 | NOISE | 21 | 10 | 25 | 40 | 8.6 | 35.1 | none | none | apache software foundation | apache traffic server | 2026-10-21 | CISA SSVC: automatable | Upgrade to Apache Traffic Server 9.2.16, 10.1.5, or 10.2.1, which fix the issue. | ||
| CVE-2026-79875 | NOISE | 21 | 0 | 33 | 50 | 9.3 | 13.7 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114141 | NOISE | 21 | 10 | 25 | 40 | 8.7 | 33.5 | none | none | binarymuse | toml-node | 2026-10-21 | CISA SSVC: automatable | Upgrade toml-node to version 5.0.1 or later, which fixes the issue. | ||
| CVE-2026-79884 | NOISE | 21 | 0 | 33 | 50 | 8.2 | 15.6 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111808 | NOISE | 21 | 10 | 25 | 40 | 8.6 | 35.1 | none | none | apache software foundation | apache traffic server | 2026-10-21 | CISA SSVC: automatable | Upgrade to Apache Traffic Server 9.2.16, 10.1.5, or 10.2.1, which fix the issue. | ||
| CVE-2026-87404 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | oracle corporation | pasta | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-79873 | NOISE | 21 | 0 | 33 | 50 | 9.3 | 15.4 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79872 | NOISE | 21 | 10 | 13 | 49 | 9.4 | 46.1 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112307 | NOISE | 21 | 9 | 25 | 40 | 7.3 | none | none | andialbrecht | sqlparse | 2026-10-19 | CISA SSVC: total technical impact | ||||
| CVE-2026-112263 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | alexpasmantier | television | 2026-10-19 | CISA SSVC: total technical impact | ||||
| CVE-2026-112238 | NOISE | 21 | 10 | 25 | 40 | 8.7 | 37.3 | none | none | typo3 | extension "file manager" | 2026-10-20 | CISA SSVC: automatable | Upgrade the ameos/ameos_filemanager extension to version 3.1.3 or later. | ||
| CVE-2026-90800 | NOISE | 21 | 10 | 25 | 40 | 8.1 | none | none | apache software foundation | apache couchdb | 2026-10-20 | CISA SSVC: total technical impact | Upgrade to Apache CouchDB 3.5.3 or later, which fixes this issue. | |||
| CVE-2026-107506 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | unknown | simple banner | 2026-10-21 | CISA SSVC: total technical impact | ||||
| CVE-2026-111949 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | unknown | miniorange 2fa | 2026-10-21 | CISA SSVC: total technical impact | ||||
| CVE-2026-112820 | NOISE | 21 | 10 | 25 | 40 | 8.1 | none | none | elated-themes | academist core | 2026-10-22 | CISA SSVC: total technical impact | ||||
| CVE-2026-111958 | NOISE | 21 | 4 | 25 | 50 | 7.5 | 2.5 | none | none | unknown | royal mcp | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-114403 | NOISE | 21 | 10 | 13 | 50 | 8.1 | 40.2 | none | phpoffice | phppresentation | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91549 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-114405 | NOISE | 21 | 10 | 25 | 40 | 8.7 | 26.6 | none | none | velneo | vserver | 2026-10-21 | CISA SSVC: automatable | Upgrade to vServer 36.6 or later in the 36.x line, or 37.2 or later in the 37.x line. | ||
| CVE-2026-111075 | NOISE | 21 | 10 | 25 | 40 | 8.7 | 29.9 | none | none | eclipse foundation | eclipse openj9 | 2026-10-21 | CISA SSVC: automatable | Upgrade Eclipse OpenJ9 to 0.63.0 or later; versions prior to 0.63.0 are affected. | ||
| CVE-2026-91445 | NOISE | 21 | 9 | 25 | 40 | 8.2 | 15.5 | none | none | oracle corporation | siebel crm end user | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-101534 | NOISE | 21 | 13 | 9 | 50 | 8.5 | none | oracle corporation | oracle edi gateway | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107571 | NOISE | 21 | 5 | 25 | 50 | 7.8 | 0.9 | none | none | progressive robot ltd | hmailserver | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-79871 | NOISE | 21 | 0 | 33 | 50 | 9.6 | 24.0 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79870 | NOISE | 21 | 0 | 33 | 49 | 9.6 | 19.0 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79890 | NOISE | 21 | 10 | 25 | 40 | 8.1 | 61.4 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-115889 | NOISE | 21 | 9 | 25 | 40 | 9.9 | 39.1 | none | none | bytecodealliance | wasmtime | 2026-10-23 | CISA SSVC: total technical impact | Upgrade to Wasmtime 36.0.19 or later, or 43.0.0 or later. | ||
| CVE-2026-86696 | NOISE | 21 | 10 | 13 | 50 | 8.2 | 37.0 | none | handnot2, arekinath | esaml | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79874 | NOISE | 21 | 0 | 33 | 50 | 9.3 | 15.4 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91250 | NOISE | 21 | 16 | 1 | 49 | 9.9 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-79863 | NOISE | 21 | 0 | 33 | 49 | 9.6 | 17.7 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-19947 | NOISE | 21 | 0 | 33 | 50 | 5.3 | 2.2 | none | none | zephyrproject | zephyr | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-116163 | NOISE | 21 | 9 | 25 | 40 | 7.4 | none | none | parse-community | parse-server | 2026-10-25 | CISA SSVC: total technical impact | ||||
| CVE-2026-87901 | NOISE | 21 | 10 | 13 | 49 | 8.3 | 21.3 | none | phpbb | phpbb | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-16762 | NOISE | 21 | 10 | 25 | 40 | 8.7 | 43.7 | none | none | qt | qt | 2026-10-23 | CISA SSVC: automatable | Upgrade Qt to 6.8.9 or later in the 6.8 branch, or to 6.11.2 or later in the 6.9+ branch; patches are in qtbase changes 738885 and 738901. | ||
| CVE-2026-112331 | NOISE | 21 | 1 | 30 | 50 | 7.5 | 52.1 | none | gdatasoftwareag | motornet | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79869 | NOISE | 21 | 0 | 33 | 49 | 9.6 | 21.8 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79868 | NOISE | 21 | 0 | 33 | 50 | 9.6 | 19.0 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79867 | NOISE | 21 | 0 | 33 | 50 | 9.6 | 21.8 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79866 | NOISE | 21 | 0 | 33 | 50 | 9.6 | 15.2 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79865 | NOISE | 21 | 0 | 33 | 50 | 9.6 | 28.4 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101647 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | oracle corporation | oracle isetup | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91604 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91517 | NOISE | 21 | 10 | 25 | 40 | 8.0 | none | none | oracle corporation | oracle management pack for oracle goldengate | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91506 | NOISE | 21 | 10 | 25 | 40 | 8.1 | none | none | oracle corporation | workflow | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91222 | NOISE | 21 | 16 | 1 | 49 | 9.9 | none | oracle corporation | oracle business process management suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-79862 | NOISE | 21 | 0 | 33 | 50 | 9.6 | 17.7 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101529 | NOISE | 21 | 16 | 1 | 50 | 9.9 | none | oracle corporation | oracle enterprise manager for oracle database | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101528 | NOISE | 21 | 16 | 1 | 49 | 9.9 | none | oracle corporation | oracle enterprise manager for oracle database | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114130 | NOISE | 21 | 0 | 33 | 50 | 2.3 | 24.8 | none | nuxt | nuxt | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101501 | NOISE | 21 | 16 | 1 | 49 | 9.9 | none | oracle corporation | oracle trusted answer search | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-82814 | NOISE | 21 | 7 | 30 | 40 | 8.8 | 44.0 | none | none | smub, duplicator | duplicator – backups & migration plugin – cloud backups, scheduled backups, & more · duplicator pro | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-79883 | NOISE | 21 | 0 | 33 | 50 | 8.3 | 12.5 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116199 | NOISE | 21 | 10 | 25 | 40 | 8.1 | none | none | grokability | snipe-it | 2026-10-25 | CISA SSVC: total technical impact | Upgrade Snipe-IT to 8.6.3 or later, which is unaffected. | |||
| CVE-2026-112854 | NOISE | 21 | 9 | 25 | 40 | 9.8 | 24.0 | none | none | axiomthemes | holistic center | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-111804 | NOISE | 21 | 9 | 25 | 40 | 8.2 | 22.3 | none | none | apache software foundation | apache traffic server | 2026-10-21 | CISA SSVC: automatable | Upgrade to Apache Traffic Server 10.1.5 or 10.2.1, which fix the issue. | ||
| CVE-2026-105944 | NOISE | 21 | 26 | 25 | 5 | 10.0 | 53.0 | none | none | apache software foundation | apache pulsar manager | 2026-10-21 | CISA SSVC: automatable; CISA SSVC: total technical impact | No fix will be released; Pulsar Manager is retired and unsupported. Remove deployments and migrate to an alternative administration UI, and rotate any exposed Pulsar credential or token signing key. | ||
| CVE-2022-51021 | NOISE | 21 | 9 | 25 | 40 | 8.2 | 39.7 | none | none | wpdeveloper | notificationx | 2026-10-22 | CISA SSVC: automatable | Update the NotificationX plugin to version 2.3.12 or later. | ||
| CVE-2026-56837 | NOISE | 21 | 10 | 25 | 40 | 8.6 | 8.3 | none | none | mervinpraison | praisonai | 2026-10-23 | CISA SSVC: automatable | Upgrade PraisonAI to version 4.6.59 or later; versions 4.6.56 through 4.6.58 are affected. | ||
| CVE-2026-63120 | NOISE | 21 | 6 | 30 | 40 | 8.4 | 34.1 | none | none | aiven-open | pghoard | 2026-10-23 | CISA SSVC: total technical impact | Upgrade to pghoard 2.7.2 or later, which patches the path traversal in restore. | ||
| CVE-2026-115727 | NOISE | 21 | 10 | 25 | 40 | 8.1 | 52.9 | none | none | fosowl | agenticseek | 2026-10-23 | CISA SSVC: total technical impact | Upgrade to commit 409840c033851d861c5c83a91c05fd4a2a75a096 or later, which removes the hardcoded Flask debug mode. | ||
| CVE-2026-114132 | NOISE | 21 | 0 | 33 | 50 | 6.3 | 36.4 | none | none | nuxt | nuxt | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-107127 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | unknown | uncanny toolkit for learndash | 2026-10-21 | CISA SSVC: total technical impact | ||||
| CVE-2026-91627 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | oracle corporation | oracle communications billing and revenue management | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91623 | NOISE | 21 | 9 | 25 | 40 | 7.4 | none | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91545 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91539 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91515 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101682 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | oracle corporation | applications dba | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101680 | NOISE | 21 | 9 | 25 | 40 | 7.4 | none | none | oracle corporation | oracle communications billing and revenue management | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101676 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | oracle corporation | oracle concurrent processing | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101665 | NOISE | 21 | 10 | 25 | 40 | 8.1 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101661 | NOISE | 21 | 9 | 25 | 40 | 7.4 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101658 | NOISE | 21 | 9 | 25 | 40 | 7.4 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101645 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | oracle corporation | oracle isetup | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101638 | NOISE | 21 | 9 | 25 | 40 | 7.3 | none | none | oracle corporation | applications dba | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101636 | NOISE | 21 | 9 | 25 | 40 | 7.4 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101469 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | oracle corporation | oracle product lifecycle analytics | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101467 | NOISE | 21 | 9 | 25 | 40 | 7.4 | none | none | oracle corporation | siebel crm end user | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101428 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-77684 | NOISE | 21 | 0 | 33 | 50 | 5.7 | 9.9 | none | none | zephyrproject | zephyr | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2025-10149 | NOISE | 21 | 9 | 25 | 40 | 8.2 | 6.9 | none | none | wso2 | wso2 identity server as key manager · wso2 open banking iam · wso2 carbon scim common component +1 more | 2026-10-19 | CISA SSVC: automatable | Apply the WSO2-2025-4438 security advisory fix: upgrade to Identity Server 5.10.0.379, 5.11.0.415, 6.0.0.251 or 6.1.0.251 (or later), IS as Key Manager 5.10.0.370, and Open Banking IAM 2.0.0.419. | ||
| CVE-2026-91354 | NOISE | 21 | 16 | 1 | 49 | 9.9 | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91537 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | oracle corporation | oracle solaris | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91546 | NOISE | 21 | 10 | 25 | 40 | 8.1 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-114057 | NOISE | 21 | 7 | 30 | 40 | 4.3 | 9.9 | poc | poc_early | arcadedata | arcadedb | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-91041 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | eclipse foundation | eclipse threadx – filex | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-112895 | NOISE | 21 | 10 | 25 | 40 | 8.7 | 20.4 | none | none | python-pillow | pillow | 2026-10-19 | CISA SSVC: automatable | Upgrade Pillow to version 13.0.0 or later, which fixes the PDF append parsing resource exhaustion. | ||
| CVE-2026-112406 | NOISE | 21 | 10 | 25 | 40 | 8.7 | 20.4 | none | none | python-pillow | pillow | 2026-10-19 | CISA SSVC: automatable | Upgrade Pillow to version 13.0.0 or later, which fixes the infinite loop in PdfParser.rewrite_pages(). | ||
| CVE-2026-112942 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | vitejs | launch-editor · vite-plus | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-109441 | NOISE | 21 | 7 | 30 | 40 | 5.8 | 28.6 | poc | poc_early | ginlix-ai | langalpha | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-113352 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | utox | utox | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-77938 | NOISE | 21 | 7 | 30 | 40 | 6.5 | 26.1 | poc | poc_early | letta-ai | letta | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-113613 | NOISE | 21 | 10 | 25 | 40 | 8.1 | none | none | flexget | flexget | 2026-10-20 | CISA SSVC: total technical impact | Upgrade to FlexGet 3.20.7 or later, which fixes the path traversal in the decompress plugin. | |||
| CVE-2026-110938 | NOISE | 21 | 10 | 25 | 40 | 8.7 | 34.7 | none | none | eclipse foundation | eclipse openj9 | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-85079 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | silicon labs | emberznet | 2026-10-22 | CISA SSVC: total technical impact | ||||
| CVE-2026-88784 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | unknown | translate wordpress with weglot 2.0 | 2026-10-21 | CISA SSVC: total technical impact | ||||
| CVE-2026-91361 | NOISE | 21 | 7 | 30 | 40 | 5.3 | 12.6 | none | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-111574 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | unknown | redirection for contact form 7 | 2026-10-21 | CISA SSVC: total technical impact | ||||
| CVE-2026-94300 | NOISE | 21 | 10 | 25 | 40 | 8.1 | 53.9 | none | none | isc | bind 9 | 2026-10-21 | CISA SSVC: total technical impact | Upgrade to the patched release closest to your branch: 9.20.30, 9.21.27, or 9.20.30-S1. No workarounds are known. | ||
| CVE-2026-94268 | NOISE | 21 | 5 | 25 | 50 | 8.1 | 24.9 | none | none | unknown | advanced custom fields: extended pro | 2026-10-23 | CISA SSVC: total technical impact | Update Advanced Custom Fields: Extended and Extended PRO to version 0.9.2.8 or later. | ||
| CVE-2026-91216 | NOISE | 21 | 16 | 1 | 49 | 10.0 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-79876 | NOISE | 21 | 0 | 33 | 50 | 9.3 | 13.9 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93471 | NOISE | 21 | 10 | 13 | 50 | 8.7 | 37.0 | none | handnot2, arekinath | esaml | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79877 | NOISE | 21 | 0 | 33 | 50 | 8.8 | 31.0 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79879 | NOISE | 21 | 0 | 33 | 50 | 8.8 | 29.3 | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2025-30052 | NOISE | 21 | 10 | 13 | 49 | 8.8 | 27.5 | none | cgm | cgm clininet | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-70387 | NOISE | 21 | 0 | 33 | 50 | 8.4 | 2.2 | none | oneplus | oxygenos | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79980 | NOISE | 21 | 0 | 33 | 50 | 5.6 | 6.7 | none | zephyrproject | zephyr | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-50057 | NOISE | 21 | 5 | 25 | 50 | 7.8 | 18.9 | none | none | zimbra | zimbra collaboration suite | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-93640 | NOISE | 21 | 5 | 25 | 50 | 7.8 | 2.1 | none | none | zimbra | zimbra collaboration suite | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-115806 | NOISE | 21 | 11 | 13 | 50 | 9.8 | 45.7 | none | codexonics | prime mover – backup and migration | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110243 | NOISE | 21 | 9 | 25 | 40 | 9.9 | 43.3 | none | none | kiloview | e3 firmware | 2026-10-22 | CISA SSVC: total technical impact | Update Kiloview E3 firmware to V1.30 or later. | ||
| CVE-2026-107186 | NOISE | 21 | 10 | 25 | 40 | 8.6 | 28.6 | none | none | eptura | archibus | 2026-10-19 | CISA SSVC: automatable | Upgrade Archibus to 2025.02 or later; versions below 2025.02 are affected. | ||
| CVE-2026-87306 | NOISE | 21 | 7 | 21 | 50 | 8.1 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101672 | NOISE | 21 | 10 | 25 | 40 | 8.1 | none | none | oracle corporation | oracle call center technology | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-114699 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 7.9 | none | none | yoomoney | юkassa для woocommerce | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-94230 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 7.3 | none | none | unknown | truebooker | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-112034 | NOISE | 20 | 7 | 25 | 40 | 4.3 | 27.0 | poc | poc_early | aircheng-org | iwebshop-5 | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112042 | NOISE | 20 | 7 | 25 | 40 | 3.5 | 9.1 | poc | poc_early | diem-project | diem | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112095 | NOISE | 20 | 7 | 25 | 40 | 3.5 | 9.1 | poc | poc_early | sourcecodester | inventory system | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-91557 | NOISE | 20 | 8 | 25 | 40 | 7.0 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-114117 | NOISE | 20 | 7 | 25 | 40 | 5.9 | 10.2 | poc | poc_early | vyperlang | vyper | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-114142 | NOISE | 20 | 0 | 13 | 65 | 8.8 | 23.2 | none | binarymuse | toml-node | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade toml-node to version 5.0.1 or later. | |||
| CVE-2026-101481 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 6.5 | none | none | oracle corporation | oracle secure backup | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91452 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 21.2 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-91440 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 17.0 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-112359 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 24.4 | none | none | amauri.io | wpmobile.app | 2026-10-23 | CISA SSVC: automatable | |||
| CVE-2026-83395 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 25.7 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-83400 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 31.4 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2022-51025 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 39.7 | poc | poc_early | penta security systems | wapples | 2026-10-22 | CISA SSVC: public proof of concept | |||
| CVE-2026-114052 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 32.2 | none | none | vllm-project | vllm | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-115785 | NOISE | 20 | 8 | 25 | 40 | 4.3 | 54.0 | none | none | zimbra | zimbra collaboration suite | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-105938 | NOISE | 20 | 0 | 30 | 50 | 2.3 | 43.4 | none | none | apache software foundation | apache pulsar | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-91497 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 21.2 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-87369 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 37.2 | none | none | oracle corporation | oracle service bus | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-94295 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 3.1 | none | none | unknown | chikkili- google pay india for woocommerce | 2026-10-25 | CISA SSVC: automatable | |||
| CVE-2026-111979 | NOISE | 20 | 3 | 25 | 50 | 6.8 | 4.4 | none | none | unknown | givewp | 2026-10-25 | CISA SSVC: total technical impact | |||
| CVE-2025-60492 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 19.0 | poc | poc_early | n/a | n/a | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-115778 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 45.2 | none | none | twisted | twisted | 2026-10-23 | CISA SSVC: automatable | |||
| CVE-2026-105199 | NOISE | 20 | 3 | 25 | 50 | 6.8 | 23.2 | none | none | unknown | pixel tag manager for woocommerce | 2026-10-24 | CISA SSVC: total technical impact | |||
| CVE-2026-105934 | NOISE | 20 | 0 | 30 | 50 | 7.2 | 41.3 | none | none | apache software foundation | apache pulsar | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-110285 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 4.0 | none | none | unknown | wp stripe checkout | 2026-10-25 | CISA SSVC: automatable | |||
| CVE-2026-114062 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 20.2 | none | none | sveltejs | kit | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-87395 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 37.2 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-115384 | NOISE | 20 | 0 | 13 | 65 | 9.9 | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to Wasmtime 48.0.4 or later, or 49.0.2 or later for the 49.x line. | ||||
| CVE-2026-114266 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 16.5 | poc | poc_early | projectworlds | advanced library management system | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-95707 | NOISE | 20 | 8 | 25 | 40 | 7.2 | 53.3 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-83402 | NOISE | 20 | 14 | 1 | 49 | 8.8 | none | oracle corporation | oracle identity manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91254 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 37.2 | none | none | oracle corporation | oracle solaris | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-96637 | NOISE | 20 | 7 | 25 | 40 | 7.1 | 36.8 | none | none | python-pillow | pillow | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-115247 | NOISE | 20 | 7 | 25 | 40 | 4.3 | 2.2 | poc | poc_early | subhajitkhan | online-clinic-management-system | 2026-10-22 | CISA SSVC: public proof of concept | |||
| CVE-2026-111817 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 29.4 | none | none | apache software foundation | apache traffic server | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-91255 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 37.2 | none | none | oracle corporation | oracle solaris | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-114576 | NOISE | 20 | 7 | 25 | 40 | 3.7 | 42.6 | poc | poc_early | linksys | re6250 | 2026-10-22 | CISA SSVC: public proof of concept | |||
| CVE-2026-91332 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 21.2 | none | none | oracle corporation | oracle java se | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-114375 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 29.4 | poc | poc_early | leomoon-studios | wiki-go | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-91468 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 16.2 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-91350 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 37.2 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-114508 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 34.6 | none | none | laravel | framework | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-114107 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 38.9 | none | none | hkuds | vibe-trading | 2026-10-21 | CISA SSVC: total technical impact | Upgrade to Vibe-Trading 0.1.7 or later; versions 0.1.0 before 0.1.7 are affected. | ||
| CVE-2026-91410 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 22.2 | none | none | oracle corporation | oracle java se | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-112032 | NOISE | 20 | 7 | 25 | 40 | 4.7 | 25.4 | poc | poc_early | aircheng-org | iwebshop-5 | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-113411 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 13.0 | poc | poc_early | nerimity | desktop | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-110893 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 7.9 | none | none | brainstorm force | suredash | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-46346 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 26.6 | none | none | intranda | goobi-viewer-core | 2026-10-23 | CISA SSVC: automatable | |||
| CVE-2026-114384 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 24.6 | poc | poc_early | itsourcecode | online cake ordering system | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-91417 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 22.2 | none | none | oracle corporation | oracle java se · oracle graalvm enterprise edition | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2025-60479 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 5.3 | poc | poc_early | n/a | n/a | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2025-60478 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 5.8 | poc | poc_early | n/a | n/a | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2025-60496 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 9.4 | poc | poc_early | n/a | n/a | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2025-71438 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 5.1 | poc | poc_early | n/a | n/a | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-112193 | NOISE | 20 | 7 | 25 | 40 | 3.7 | 28.8 | poc | poc_early | webkul | aureus erp | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-91418 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 33.3 | none | none | oracle corporation | oracle java se · oracle javafx · oracle graalvm for jdk +1 more | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-114381 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 24.6 | poc | poc_early | itsourcecode | online cake ordering system | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-112302 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 34.1 | poc | poc_early | kiwilan | php-archive | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112770 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 47.1 | none | none | craftcms | cms | 2026-10-19 | CISA SSVC: total technical impact | Upgrade to Craft CMS 4.18.8 or later in the 4.x line, or 5.11.0 or later in the 5.x line. | ||
| CVE-2026-55835 | NOISE | 20 | 7 | 25 | 40 | 6.9 | 33.3 | none | none | lookyloo | lookyloo | 2026-10-23 | CISA SSVC: automatable | |||
| CVE-2026-114378 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 17.8 | poc | poc_early | itsourcecode | online cake ordering system | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-110894 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 7.9 | none | none | brainstorm force | suredash | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-91541 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 25.7 | none | none | oracle corporation | peoplesoft enterprise fin common objects brazil | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-91442 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 21.0 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101508 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 39.0 | none | none | oracle corporation | siebel crm integration | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-114100 | NOISE | 20 | 7 | 25 | 40 | 5.8 | 12.5 | none | none | corazawaf | coraza | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-101518 | NOISE | 20 | 14 | 1 | 49 | 8.8 | none | oracle corporation | oracle enterprise manager base platform | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114390 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 12.8 | none | none | chamilo | chamilo-lms | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-107685 | NOISE | 20 | 0 | 13 | 65 | 9.1 | 19.5 | none | agentjido | req_llm | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade req_llm to 1.29.0 or later; the patch commit c7264fc0217fbacfb5562234ff790b8e4462de76 is referenced in the vendor advisory GHSA-6vww-5m28-f26v. | |||
| CVE-2026-114077 | NOISE | 20 | 7 | 25 | 40 | 7.1 | 14.3 | poc | poc_early | triggerdotdev | trigger.dev | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-114180 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 6.8 | none | none | wpmet | metform | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-101814 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 23.3 | none | none | oracle corporation | oracle engineering | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-82230 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 45.3 | none | none | apache software foundation | apache brpc | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-91465 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 22.8 | none | none | oracle corporation | peoplesoft enterprise fin common objects argentina | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-105942 | NOISE | 20 | 4 | 30 | 40 | 7.7 | 41.3 | none | none | apache software foundation | apache pulsar | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-114080 | NOISE | 20 | 0 | 30 | 50 | 5.0 | none | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2025-60493 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 6.1 | poc | poc_early | n/a | n/a | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-93856 | NOISE | 20 | 7 | 25 | 40 | 4.3 | 23.1 | poc | poc_early | openstack | cinder | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-112401 | NOISE | 20 | 7 | 25 | 40 | 6.9 | 29.6 | none | none | python-pillow | pillow | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-101359 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 21.2 | none | none | oracle corporation | oracle rest data services | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-101394 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 19.6 | none | none | oracle corporation | siebel apps – marketing | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-101520 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 38.9 | none | none | oracle corporation | oracle global lifecycle management nextgen oui framework | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-101569 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 27.5 | none | none | oracle corporation | helidon | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-114110 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 18.5 | none | none | astral-sh | uv | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-114404 | NOISE | 20 | 7 | 25 | 40 | 6.1 | 16.5 | none | none | phpoffice | phppresentation | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-101581 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 25.7 | none | none | oracle corporation | helidon | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-19630 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 37.9 | none | none | isc | bind 9 | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-101587 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 31.4 | none | none | oracle corporation | helidon | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-96888 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 39.0 | none | none | isc | bind 9 | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-91189 | NOISE | 20 | 8 | 25 | 40 | 7.1 | none | none | eclipse foundation | eclipse threadx – guix | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-107755 | NOISE | 20 | 8 | 25 | 40 | 6.0 | none | none | apache software foundation | apache couchdb | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-113406 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 29.8 | none | none | ys-infoware | ba-workflow | 2026-10-20 | CISA SSVC: total technical impact | Update to BA-Workflow v3.6.2.7 or later. | ||
| CVE-2026-101679 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 35.8 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-113404 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 27.3 | none | none | uniong | webitr | 2026-10-20 | CISA SSVC: total technical impact | Update to WebITR version 2_1_0_36 or later. | ||
| CVE-2026-111762 | NOISE | 20 | 0 | 30 | 50 | 5.7 | none | a2aproject | a2a-java | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113403 | NOISE | 20 | 8 | 25 | 40 | 6.5 | 56.7 | none | none | armorx global technology | armorx spam | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101542 | NOISE | 20 | 14 | 1 | 49 | 8.8 | none | oracle corporation | oracle capacity | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101720 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 22.6 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-112237 | NOISE | 20 | 7 | 25 | 40 | 6.9 | 34.8 | none | none | typo3 | extension "kitodo.presentation" | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-112070 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 27.3 | none | none | typo3 | extension "analytics" | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-113405 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 29.8 | none | none | ys-infoware | ba-workflow | 2026-10-20 | CISA SSVC: total technical impact | Update to version v3.6.2.7 or later. | ||
| CVE-2026-113380 | NOISE | 20 | 8 | 25 | 40 | 9.3 | 20.0 | none | none | signal | ringrtc | 2026-10-20 | CISA SSVC: total technical impact | Upgrade RingRTC to 2.72.0 or later (fixed in the v2.71.0…v2.72.0 range). | ||
| CVE-2026-113407 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 29.8 | none | none | ys-infoware | ba-workflow | 2026-10-20 | CISA SSVC: total technical impact | Update to BA-Workflow version 3.6.2.7 or later. | ||
| CVE-2026-113468 | NOISE | 20 | 7 | 25 | 40 | 6.9 | 33.4 | none | none | typo3 | extension "typo3 shop by coding.ms" | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-114042 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 16.0 | poc | poc_early | freerdp | freerdp | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-113459 | NOISE | 20 | 7 | 25 | 40 | 7.1 | 30.8 | none | none | typo3 | extension "typo3 ai integration extension" | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-91213 | NOISE | 20 | 14 | 1 | 49 | 8.8 | none | oracle corporation | oracle business process management suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-93300 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 34.3 | none | none | eventon | eventon – subscriber | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-112299 | NOISE | 20 | 7 | 25 | 40 | 4.3 | 30.6 | poc | poc_early | smrealms | smr | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-91215 | NOISE | 20 | 14 | 1 | 49 | 8.8 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91259 | NOISE | 20 | 14 | 1 | 49 | 8.8 | none | oracle corporation | oracle identity manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110018 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 32.5 | none | none | kodezen | ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builder | 2026-10-24 | CISA SSVC: total technical impact | |||
| CVE-2026-112372 | NOISE | 20 | 7 | 25 | 40 | 6.6 | 32.4 | poc | poc_early | h3c | magic nx15 | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-108120 | NOISE | 20 | 8 | 25 | 40 | 7.7 | 29.2 | none | none | koozali | sme server | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-91344 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 37.2 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-91345 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 37.2 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-91349 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 24.2 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-112210 | NOISE | 20 | 8 | 25 | 40 | 6.0 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 7 · red hat enterprise linux 8 +1 more | 2026-10-19 | CISA SSVC: total technical impact | ||||
| CVE-2026-94272 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 7.3 | none | none | unknown | snap finance | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-47025 | NOISE | 20 | 14 | 1 | 50 | 8.8 | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-74922 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 1.5 | none | none | unknown | document gallery | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-94229 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 8.4 | none | none | unknown | truebooker | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-94231 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 7.3 | none | none | unknown | truebooker | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-112074 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 14.1 | poc | poc_early | tencent | ncnn | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112039 | NOISE | 20 | 7 | 25 | 40 | 2.4 | 10.6 | poc | poc_early | diem-project | diem | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-101654 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 37.3 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-112035 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 19.5 | poc | poc_early | aircheng-org | iwebshop-5 | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112031 | NOISE | 20 | 7 | 25 | 40 | 3.5 | 9.7 | poc | poc_early | chamilo | lms | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-91451 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 21.2 | none | none | oracle corporation | oracle java se | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-57144 | NOISE | 20 | 0 | 13 | 65 | 8.8 | 2.1 | none | mervinpraison | praisonai | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to PraisonAI 4.6.61 or later, which patches the sandbox fallback. | |||
| CVE-2026-101655 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 37.3 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-112821 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 10.7 | none | none | knit pay | knit pay | 2026-10-23 | CISA SSVC: automatable | |||
| CVE-2026-114195 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 9.0 | none | none | wp desk | shopmagic | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-81813 | NOISE | 20 | 8 | 25 | 40 | 6.8 | none | none | unknown | elementor website builder | 2026-10-21 | CISA SSVC: total technical impact | ||||
| CVE-2026-79627 | NOISE | 20 | 8 | 25 | 40 | 7.1 | none | none | unknown | advanced file manager | 2026-10-21 | CISA SSVC: total technical impact | ||||
| CVE-2026-116019 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 28.2 | none | none | getgrav | grav | 2026-10-24 | CISA SSVC: total technical impact | Upgrade Grav to 2.2.13 or later; the fix is included in the 2.2.13 release. | ||
| CVE-2026-9659 | NOISE | 20 | 4 | 21 | 50 | 9.1 | 55.8 | none | totolink | totolink | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2025-55667 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 13.8 | poc | poc_early | n/a | n/a | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-94294 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 11.7 | none | none | unknown | app builder | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2025-55654 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 5.5 | poc | poc_early | n/a | n/a | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-105932 | NOISE | 20 | 0 | 30 | 50 | 2.3 | 42.8 | none | none | apache software foundation | apache pulsar | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-112777 | NOISE | 20 | 7 | 25 | 40 | 7.2 | 40.8 | none | none | craftcms | cms | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-112772 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 46.9 | none | none | craftcms | cms | 2026-10-19 | CISA SSVC: total technical impact | Upgrade Craft CMS to 5.11.0 or later; versions from 5.0.0 before 5.11.0 are affected. | ||
| CVE-2026-108984 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 17.0 | none | none | geovision inc. | gv-asmanager | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-91268 | NOISE | 20 | 14 | 1 | 50 | 8.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112033 | NOISE | 20 | 7 | 25 | 40 | 4.3 | 4.6 | poc | poc_early | aircheng-org | iwebshop-5 | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112306 | NOISE | 20 | 8 | 25 | 40 | 7.2 | none | none | nocobase | nocobase | 2026-10-19 | CISA SSVC: total technical impact | ||||
| CVE-2026-112096 | NOISE | 20 | 7 | 25 | 40 | 3.5 | 9.1 | poc | poc_early | sourcecodester | inventory system | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-101557 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 44.7 | none | none | oracle corporation | oracle purchasing | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-112092 | NOISE | 20 | 7 | 25 | 40 | 4.3 | 18.5 | poc | poc_early | subhajitkhan | online-clinic-management-system | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112089 | NOISE | 20 | 7 | 25 | 40 | 4.7 | 10.6 | poc | poc_early | dav-ee | dairy-management-system | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112088 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 9.3 | poc | poc_early | dav-ee | dairy-management-system | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112078 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 14.7 | poc | poc_early | rvc-project | retrieval-based-voice-conversion-webui | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112081 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 25.6 | poc | poc_early | hankcs | hanlp | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112087 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 15.3 | poc | poc_early | itsourcecode | online cake ordering system | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2025-60489 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 12.3 | poc | poc_early | n/a | n/a | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-78118 | NOISE | 20 | 3 | 25 | 50 | 7.0 | 1.0 | none | none | zephyrproject | zephyr | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-101399 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 31.4 | none | none | oracle corporation | siebel apps – marketing | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-96643 | NOISE | 20 | 7 | 25 | 40 | 7.1 | 36.8 | none | none | python-pillow | pillow | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-91340 | NOISE | 20 | 14 | 1 | 49 | 8.8 | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115360 | NOISE | 20 | 7 | 25 | 40 | 4.7 | 16.0 | none | none | openbao | openbao | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-75507 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 48.4 | none | none | graphql-python | graphql-core | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-10136 | NOISE | 20 | 7 | 25 | 40 | 9.1 | 48.3 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-92162 | NOISE | 20 | 8 | 25 | 40 | 7.2 | none | none | flatpak | flatpak | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-114613 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 38.0 | none | none | msgpack | msgpack-python | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-9869 | NOISE | 20 | 7 | 25 | 40 | 9.1 | 43.4 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-79956 | NOISE | 20 | 8 | 25 | 40 | 7.2 | 53.0 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-113808 | NOISE | 20 | 8 | 25 | 40 | 7.1 | none | none | stormshield | stormshield network security | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-96902 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 7.7 | none | none | unknown | easy property listings | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-112073 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 14.1 | poc | poc_early | tencent | ncnn | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-91395 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 17.8 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-91396 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 27.5 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-101572 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 37.2 | none | none | oracle corporation | helidon | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-91218 | NOISE | 20 | 15 | 1 | 50 | 9.6 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114067 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 11.9 | poc | poc_early | triggerdotdev | trigger.dev | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-109935 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 20.5 | none | none | unknown | otter blocks | 2026-10-23 | CISA SSVC: automatable | |||
| CVE-2026-101813 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 37.3 | none | none | oracle corporation | oracle engineering | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101852 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 38.6 | none | none | oracle corporation | oracle product hub | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-114076 | NOISE | 20 | 0 | 30 | 50 | 5.4 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101692 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 40.0 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101664 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 37.3 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101853 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 38.6 | none | none | oracle corporation | oracle product hub | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101854 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 38.6 | none | none | oracle corporation | oracle product hub | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-115377 | NOISE | 20 | 1 | 13 | 65 | 9.9 | 34.5 | none | lxc | incus | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to Incus 6.0.7 or later, 7.0.2 or later, or 7.5.0 or later, depending on your release line. | |||
| CVE-2026-112312 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 13.3 | none | none | acf extended | acf extended | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-112368 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 17.0 | none | none | mongodb inc. | php driver | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-87349 | NOISE | 20 | 8 | 25 | 40 | 6.5 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-114696 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 7.9 | none | none | miniorange | page restriction wordpress (wp) | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-115375 | NOISE | 20 | 0 | 13 | 65 | 9.9 | 34.5 | none | lxc | incus | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to Incus 7.0.2 or later on the 7.0.x line, or to 7.5.0 or later on the 7.1.x line. | |||
| CVE-2026-107567 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 5.5 | none | none | progressive robot ltd | hmailserver | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-112045 | NOISE | 20 | 7 | 25 | 40 | 5.4 | 13.5 | poc | poc_early | n/a | donetick | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-91448 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 33.8 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-115728 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 40.1 | none | none | hapijs | @hapi/content | 2026-10-23 | CISA SSVC: automatable | |||
| CVE-2026-83363 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 38.6 | none | none | oracle corporation | oracle contract lifecycle management for public sector | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91494 | NOISE | 20 | 4 | 33 | 40 | 7.4 | 22.6 | none | none | oracle corporation | oracle identity manager connector | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2025-71434 | NOISE | 20 | 10 | 13 | 45 | 8.2 | 24.6 | none | weaver network co., ltd. | e-cology | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to E-cology 10.76 or later; versions 8.0, 9.0 and 10.0 prior to 10.76 are affected. See the Weaver security advisory for details. | |||
| CVE-2026-91499 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 32.8 | none | none | oracle corporation | oracle database server | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91502 | NOISE | 20 | 8 | 25 | 40 | 7.3 | 21.2 | none | none | oracle corporation | oracle weblogic server | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-95705 | NOISE | 20 | 8 | 25 | 40 | 7.2 | 66.7 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-95706 | NOISE | 20 | 8 | 25 | 40 | 7.2 | 66.7 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-113490 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 20.5 | none | none | unknown | geodirectory | 2026-10-24 | CISA SSVC: automatable | |||
| CVE-2026-74757 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 14.5 | none | none | apache software foundation | apache brpc | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-113492 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 20.5 | none | none | unknown | geodirectory | 2026-10-24 | CISA SSVC: automatable | |||
| CVE-2026-114192 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 12.3 | none | none | magepeople inc. | wpevently | 2026-10-24 | CISA SSVC: automatable | |||
| CVE-2026-87835 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 15.7 | none | none | unknown | front end users | 2026-10-24 | CISA SSVC: automatable | |||
| CVE-2026-115981 | NOISE | 20 | 7 | 25 | 40 | 2.4 | 16.6 | poc | poc_early | n/a | phpipam | 2026-10-24 | CISA SSVC: public proof of concept | |||
| CVE-2026-114705 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 12.9 | none | none | quadlayers | wp social feed gallery | 2026-10-24 | CISA SSVC: automatable | |||
| CVE-2026-101656 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 37.3 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-110825 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 35.3 | none | none | kiloview | e3 firmware | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-113810 | NOISE | 20 | 8 | 25 | 40 | 7.0 | none | none | stormshield | stormshield network security | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91447 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 31.4 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-109122 | NOISE | 20 | 7 | 25 | 40 | 9.1 | 44.0 | none | none | kiloview | e3 firmware | 2026-10-22 | CISA SSVC: total technical impact | Update Kiloview E3 firmware to V1.30 or later; versions below 1.30 are affected. | ||
| CVE-2026-79894 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 35.1 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2012-20003 | NOISE | 20 | 7 | 25 | 40 | 6.1 | 18.9 | poc | poc_early | web updates kmu | custom tables | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-115329 | NOISE | 20 | 0 | 38 | 40 | 5.9 | 17.2 | none | none | uselotus | lotus | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-79895 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 43.4 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-95715 | NOISE | 20 | 8 | 25 | 40 | 6.8 | 75.4 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2025-60497 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 15.4 | poc | poc_early | n/a | n/a | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2025-60494 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 15.6 | poc | poc_early | n/a | n/a | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-91243 | NOISE | 20 | 15 | 1 | 49 | 9.6 | none | oracle corporation | oracle business process management suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-42025 | NOISE | 20 | 7 | 25 | 40 | 9.1 | 43.4 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-103634 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 9.0 | none | none | apache software foundation | apache datasketches | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-82953 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 12.0 | none | none | apache software foundation | apache brpc | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-114112 | NOISE | 20 | 7 | 25 | 40 | 8.9 | 8.4 | none | none | lovell | sharp | 2026-10-21 | CISA SSVC: total technical impact | Upgrade sharp to 0.35.4 or later, which bundles a fixed libheif dependency. | ||
| CVE-2026-114729 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 30.3 | none | none | roundcube | webmail | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-114728 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 30.7 | none | none | roundcube | webmail | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-115348 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 37.8 | none | none | lepture | mistune | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-114479 | NOISE | 20 | 7 | 25 | 40 | 5.8 | 23.9 | none | none | progressive robot ltd | hmailserver | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-114092 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 36.8 | poc | poc_early | triggerdotdev | trigger.dev | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-101781 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 18.6 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101759 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 32.8 | none | none | oracle corporation | oracle communications billing and revenue management | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-101742 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 37.8 | none | none | oracle corporation | oracle applications manager | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101716 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 24.9 | none | none | oracle corporation | oracle agile plm | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-101635 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 37.3 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101596 | NOISE | 20 | 14 | 1 | 49 | 8.8 | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114045 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 40.7 | none | none | freerdp | freerdp | 2026-10-21 | CISA SSVC: total technical impact | Upgrade FreeRDP to 3.32.1 or later; versions before 3.32.1 are affected. | ||
| CVE-2026-114395 | NOISE | 20 | 7 | 25 | 40 | 4.3 | 23.0 | poc | poc_early | polonel | trudesk | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-114055 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 26.6 | none | none | vllm-project | vllm | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-115352 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 37.8 | none | none | lepture | mistune | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-115893 | NOISE | 20 | 1 | 13 | 65 | 9.9 | 37.3 | none | bytecodealliance | wasmtime | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade Wasmtime to 36.0.19, 48.0.7, or 49.0.4 (or later) depending on your release line. | |||
| CVE-2026-115895 | NOISE | 20 | 0 | 13 | 65 | 8.8 | 30.2 | none | capricorn86 | happy-dom | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade happy-dom to version 21.0.4 or later, which fixes this issue. | |||
| CVE-2026-114396 | NOISE | 20 | 7 | 25 | 40 | 7.1 | 40.2 | poc | poc_early | polonel | trudesk | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-92822 | NOISE | 20 | 7 | 25 | 40 | 6.2 | 1.6 | poc | poc_early | red hat | red hat enterprise linux 10 · red hat enterprise linux 8 · red hat enterprise linux 9 +2 more | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-50787 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 23.6 | none | none | n/a | n/a | 2026-10-23 | CISA SSVC: automatable | |||
| CVE-2026-115800 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 3.1 | poc | poc_early | ubiquitouslearning | mllm | 2026-10-23 | CISA SSVC: public proof of concept | |||
| CVE-2025-52290 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 34.9 | none | none | n/a | n/a | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-114348 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 26.6 | none | none | webpack-dev-server | webpack-dev-server | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-100142 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 3.6 | none | none | unknown | fluentcart a new era of ecommerce | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-94273 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 2.7 | none | none | unknown | snap finance | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-83403 | NOISE | 20 | 14 | 1 | 49 | 8.8 | none | oracle corporation | oracle identity manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109987 | NOISE | 20 | 7 | 25 | 40 | 7.2 | 6.4 | none | none | unknown | pixelyoursite pro | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-114177 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 2.6 | none | none | xpro | xpro elementor addons | 2026-10-22 | CISA SSVC: total technical impact | Update the Xpro Elementor Addons plugin to version 1.7.11 or later. | ||
| CVE-2026-87403 | NOISE | 20 | 8 | 25 | 40 | 7.1 | none | none | oracle corporation | applications dba | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-111842 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 6.8 | none | none | wp sunshine | sunshine photo cart | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-112218 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 6.8 | none | none | ahmad | majestic support | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-112311 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 18.5 | none | none | acf extended | acf extended | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-91432 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 18.6 | none | none | oracle corporation | siebel crm end user | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-91505 | NOISE | 20 | 8 | 25 | 40 | 6.0 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91453 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 21.2 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-79893 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 44.9 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-113710 | NOISE | 20 | 8 | 25 | 40 | 5.9 | none | none | apostrophecms | apostrophe | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-114400 | NOISE | 20 | 7 | 25 | 40 | 5.9 | 45.9 | poc | poc_early | polonel | trudesk | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-116007 | NOISE | 20 | 7 | 25 | 40 | 3.7 | 30.7 | poc | poc_early | yunaiv, zhijiantianya | ruoyi-vue-pro | 2026-10-25 | CISA SSVC: public proof of concept | |||
| CVE-2025-69723 | NOISE | 20 | 7 | 25 | 40 | 6.1 | 3.9 | poc | poc_early | n/a | n/a | 2026-10-22 | CISA SSVC: public proof of concept | |||
| CVE-2026-95709 | NOISE | 20 | 8 | 25 | 40 | 7.2 | 69.5 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-95708 | NOISE | 20 | 8 | 25 | 40 | 7.2 | 69.5 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-91476 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 24.3 | none | none | oracle corporation | peoplesoft enterprise fin common objects brazil | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-112300 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 33.4 | none | none | diffsk | configobj | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2025-60490 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 15.0 | poc | poc_early | n/a | n/a | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2025-60487 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 12.4 | poc | poc_early | n/a | n/a | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2026-91373 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 31.4 | none | none | oracle corporation | oracle java se | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-101567 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 44.7 | none | none | oracle corporation | oracle cost management | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91352 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 20.7 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-87398 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 37.2 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-115586 | NOISE | 20 | 3 | 25 | 50 | 7.1 | 9.5 | none | none | pypa | virtualenv | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-10133 | NOISE | 20 | 7 | 25 | 40 | 9.1 | 48.3 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-112038 | NOISE | 20 | 7 | 25 | 40 | 2.4 | 10.6 | poc | poc_early | diem-project | diem | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112037 | NOISE | 20 | 7 | 25 | 40 | 3.7 | 7.0 | poc | poc_early | diem-project | diem | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2025-60469 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 6.7 | poc | poc_early | n/a | n/a | 2026-10-21 | CISA SSVC: public proof of concept | |||
| CVE-2025-60475 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 12.6 | poc | poc_early | n/a | n/a | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-21811 | NOISE | 20 | 0 | 30 | 50 | 3.8 | 7.5 | none | hcl software | appscan integration with azure boards for asoc & a360 | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112041 | NOISE | 20 | 7 | 25 | 40 | 3.7 | 22.2 | poc | poc_early | diem-project | diem | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-105930 | NOISE | 20 | 0 | 30 | 50 | 6.0 | 38.3 | none | none | apache software foundation | apache pulsar | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-111757 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 12.1 | none | none | honojs | hono | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-114143 | NOISE | 20 | 0 | 13 | 65 | 8.7 | 20.6 | none | binarymuse | toml-node | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to toml-node 5.0.1 or later, which fixes the quadratic path handling. | |||
| CVE-2026-101745 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 23.3 | none | none | oracle corporation | oracle agile engineering data management | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-89286 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 3.4 | none | none | unknown | formflow for gohighlevel (ghl) | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-112782 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 21.8 | none | none | getgrav | grav | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-112373 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 29.3 | poc | poc_early | h3c | magic nx15 | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-112076 | NOISE | 20 | 7 | 25 | 40 | 5.6 | 18.0 | poc | poc_early | alexta69 | metube | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-56833 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 39.6 | none | none | mervinpraison | praisonai | 2026-10-23 | CISA SSVC: automatable | |||
| CVE-2026-112080 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 23.0 | poc | poc_early | llamachinese | llama-chinese | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-114475 | NOISE | 20 | 0 | 30 | 50 | 6.5 | 13.9 | none | progressive robot ltd | hmailserver | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112086 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 23.1 | poc | poc_early | n/a | espnet | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-114140 | NOISE | 20 | 0 | 13 | 65 | 8.8 | 22.9 | none | jupyter | nbconvert | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade nbconvert to version 7.17.2 or later, which fixes the path traversal in ExtractOutputPreprocessor. | |||
| CVE-2026-112358 | NOISE | 20 | 7 | 25 | 40 | 4.1 | 15.7 | poc | poc_early | tibillet | lespass | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112044 | NOISE | 20 | 8 | 25 | 40 | 7.3 | 33.4 | none | none | dotnet | eshop | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-110898 | NOISE | 20 | 8 | 25 | 40 | 6.4 | none | none | wpdeveloper | essential addons for elementor | 2026-10-19 | CISA SSVC: total technical impact | ||||
| CVE-2026-111810 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 29.5 | none | none | apache software foundation | apache traffic server | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-79955 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 44.9 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-112090 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 9.3 | poc | poc_early | dav-ee | dairy-management-system | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112094 | NOISE | 20 | 7 | 25 | 40 | 5.5 | 7.1 | poc | poc_early | michaelrsweet | mxml | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112098 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 23.0 | poc | poc_early | n/a | deeppavlov | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-101653 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 37.3 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-112177 | NOISE | 20 | 8 | 25 | 40 | 7.3 | 16.7 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-112891 | NOISE | 20 | 7 | 25 | 40 | 6.9 | 29.6 | none | none | python-pillow | pillow | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-114125 | NOISE | 20 | 0 | 13 | 65 | 8.6 | 30.3 | none | storybookjs | storybook | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6 or later. | |||
| CVE-2026-101526 | NOISE | 20 | 14 | 1 | 49 | 8.8 | none | oracle corporation | oracle enterprise manager for siebel | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115372 | NOISE | 20 | 0 | 13 | 65 | 8.5 | 29.7 | none | lxc | incus | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade Incus to 7.5.0 or later; versions 7.3.0 through 7.4.x are affected. | |||
| CVE-2026-112901 | NOISE | 20 | 7 | 25 | 40 | 6.9 | 20.4 | none | none | python-pillow | pillow | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-101783 | NOISE | 20 | 4 | 33 | 40 | 7.4 | 23.5 | none | none | oracle corporation | mysql router | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91295 | NOISE | 20 | 14 | 1 | 49 | 8.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87347 | NOISE | 20 | 15 | 1 | 49 | 9.6 | none | oracle corporation | oracle http server | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91047 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 3.4 | none | none | unknown | elementsready addons for elementor | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-87364 | NOISE | 20 | 14 | 1 | 49 | 8.8 | none | oracle corporation | oracle service bus | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91223 | NOISE | 20 | 14 | 1 | 50 | 8.8 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-92208 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 49.3 | none | none | nomachine | nomachine | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-87351 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 37.3 | none | none | oracle corporation | oracle goldengate | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-105949 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 25.7 | none | none | red hat | streams for apache kafka 2 · streams for apache kafka 3 | 2026-10-20 | CISA SSVC: total technical impact | No patch stated; restrict Cruise Control port 9090 to operator pods via Strimzi NetworkPolicy, keep it off Ingress/Route, and ensure TLS is enabled on the CC HTTP endpoint. | ||
| CVE-2025-31699 | NOISE | 20 | 7 | 25 | 40 | 8.9 | 28.1 | none | none | apache software foundation | apache traffic server | 2026-10-21 | CISA SSVC: total technical impact | Upgrade to Apache Traffic Server 9.2.16, 10.1.5, or 10.2.1, which fix the issue. | ||
| CVE-2026-91478 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 37.3 | none | none | oracle corporation | peoplesoft enterprise scm strategic sourcing | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101420 | NOISE | 20 | 8 | 25 | 40 | 9.6 | 29.8 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2012-20004 | NOISE | 20 | 7 | 25 | 40 | 6.1 | 18.9 | poc | poc_early | carles reverter | k-news | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-113712 | NOISE | 20 | 7 | 25 | 40 | 4.8 | 39.6 | poc | poc_early | cachethq | cachet | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-113669 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 35.6 | poc | poc_early | apostrophecms, @apostrophecms | apostrophe · passport-bridge | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-113606 | NOISE | 20 | 7 | 25 | 40 | 7.1 | 29.9 | poc | poc_early | stirling-tools | stirling-pdf | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-87263 | NOISE | 20 | 14 | 1 | 49 | 8.8 | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112949 | NOISE | 20 | 7 | 25 | 40 | 4.7 | 26.8 | poc | poc_early | vitest-dev, @vitest | vitest · mocker | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-114123 | NOISE | 20 | 0 | 30 | 50 | 7.5 | 35.5 | none | dynamics365ninja | d365fo-mcp-server | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113394 | NOISE | 20 | 8 | 25 | 40 | 7.4 | 23.5 | poc | poc_early | draytek | vigor2960 | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-113354 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 14.1 | poc | poc_early | finsys | dockhand | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-112909 | NOISE | 20 | 7 | 25 | 40 | 6.1 | 1.6 | poc | poc_early | tox-dev | filelock | 2026-10-20 | CISA SSVC: public proof of concept | |||
| CVE-2026-11319 | NOISE | 20 | 7 | 25 | 40 | 6.2 | 2.8 | poc | poc_early | ticktick limited | ticktick for android | 2026-10-19 | CISA SSVC: public proof of concept | |||
| CVE-2026-112780 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 21.8 | none | none | getgrav | grav | 2026-10-19 | CISA SSVC: total technical impact | Upgrade Grav to 2.2.2 or later; versions from 2.0.15 before 2.2.2 are affected. | ||
| CVE-2026-91489 | NOISE | 20 | 3 | 33 | 40 | 7.1 | 1.0 | none | none | oracle corporation | oracle identity manager connector | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91512 | NOISE | 20 | 8 | 25 | 40 | 7.2 | none | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-91239 | NOISE | 20 | 14 | 1 | 49 | 8.8 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91386 | NOISE | 20 | 8 | 25 | 40 | 6.8 | none | none | oracle corporation | jd edwards enterpriseone orchestrator | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-83427 | NOISE | 20 | 8 | 25 | 40 | 6.6 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-60885 | NOISE | 20 | 8 | 25 | 40 | 6.8 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101683 | NOISE | 20 | 8 | 25 | 40 | 7.0 | none | none | oracle corporation | applications dba | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101681 | NOISE | 20 | 8 | 25 | 40 | 7.0 | none | none | oracle corporation | applications dba | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101675 | NOISE | 20 | 8 | 25 | 40 | 6.7 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101674 | NOISE | 20 | 8 | 25 | 40 | 6.7 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101669 | NOISE | 20 | 8 | 25 | 40 | 6.8 | none | none | oracle corporation | oracle public sector human resources | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101646 | NOISE | 20 | 8 | 25 | 40 | 7.2 | none | none | oracle corporation | oracle isetup | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101644 | NOISE | 20 | 8 | 25 | 40 | 6.6 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101465 | NOISE | 20 | 8 | 25 | 40 | 6.3 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101464 | NOISE | 20 | 8 | 25 | 40 | 7.1 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-101429 | NOISE | 20 | 8 | 25 | 40 | 7.0 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-107569 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 29.7 | none | none | progressive robot ltd | hmailserver | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-107188 | NOISE | 20 | 8 | 25 | 40 | 9.6 | 30.1 | none | none | eptura | archibus | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-113679 | NOISE | 20 | 8 | 25 | 40 | 7.0 | none | none | harfbuzz | harfbuzz | 2026-10-20 | CISA SSVC: total technical impact | ||||
| CVE-2026-57117 | NOISE | 20 | 0 | 13 | 65 | 8.8 | 34.1 | none | mervinpraison | praisonai | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade PraisonAI to version 4.6.59 or later. | |||
| CVE-2025-71437 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 20.0 | none | none | astral-sh | uv | 2026-10-21 | CISA SSVC: automatable | |||
| CVE-2026-106028 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 3.5 | none | none | unknown | activetrail for woocommerce | 2026-10-19 | CISA SSVC: automatable | |||
| CVE-2026-112242 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 13.3 | none | none | cozmoslabs | profile builder | 2026-10-22 | CISA SSVC: total technical impact | Update the Profile Builder plugin to at least version 4.0.5. | ||
| CVE-2026-105927 | NOISE | 20 | 0 | 30 | 50 | 2.3 | 37.0 | none | apache software foundation | apache pulsar | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105931 | NOISE | 20 | 0 | 30 | 50 | 2.3 | 42.2 | none | apache software foundation | apache pulsar | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91241 | NOISE | 20 | 14 | 1 | 49 | 9.1 | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116186 | NOISE | 20 | 0 | 38 | 40 | 2.3 | none | openremote | core | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112826 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 7.9 | none | none | elightup | falcon – wordpress optimizations & tweaks | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-9817 | NOISE | 20 | 7 | 25 | 40 | 9.1 | 43.4 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-42026 | NOISE | 20 | 7 | 25 | 40 | 9.1 | 43.4 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-10137 | NOISE | 20 | 7 | 25 | 40 | 9.1 | 48.3 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-10139 | NOISE | 20 | 7 | 25 | 40 | 9.1 | 49.6 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-10132 | NOISE | 20 | 7 | 25 | 40 | 9.1 | 48.3 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-105270 | NOISE | 20 | 10 | 13 | 45 | 8.7 | 26.7 | none | arekinath, handnot2 | esaml | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110510 | NOISE | 19 | 0 | 25 | 50 | 3.5 | 1.4 | none | none | unknown | essential addons for elementor | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-114743 | NOISE | 19 | 0 | 25 | 50 | 3.1 | 6.1 | none | none | unknown | instawp connect | 2026-10-25 | no exploitation evidence in any monitored source | |||
| CVE-2026-101459 | NOISE | 19 | 13 | 1 | 49 | 8.3 | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111090 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 1.8 | none | none | stormshield | stormshield network security | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-57146 | NOISE | 19 | 0 | 25 | 50 | 7.5 | 27.6 | none | mervinpraison | praisonai | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-66279 | NOISE | 19 | 0 | 25 | 50 | 7.2 | 15.6 | none | none | silicon labs | connect sdk | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-112360 | NOISE | 19 | 5 | 25 | 40 | 8.0 | 31.3 | none | none | netis | eap930 | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-91483 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 15.2 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101505 | NOISE | 19 | 13 | 0 | 49 | 8.7 | none | oracle corporation | oracle trusted answer search | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91046 | NOISE | 19 | 0 | 25 | 50 | 4.3 | 3.5 | none | none | unknown | elementsready addons for elementor | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-116070 | NOISE | 19 | 0 | 25 | 50 | 6.5 | none | dqzboy | docker-proxy | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-93878 | NOISE | 19 | 0 | 25 | 50 | 6.4 | 4.7 | none | none | divigear | divigear carousel | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-111766 | NOISE | 19 | 0 | 25 | 50 | 3.7 | none | none | markdown-it | markdown-it | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114063 | NOISE | 19 | 0 | 25 | 50 | 7.5 | 33.6 | none | sveltejs | kit | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112258 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 2.7 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-112077 | NOISE | 19 | 0 | 25 | 50 | 5.6 | 19.7 | none | none | radareorg | radare2 | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-112784 | NOISE | 19 | 0 | 25 | 50 | 4.3 | none | none | opencats | opencats | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79889 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 49.7 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-113496 | NOISE | 19 | 0 | 25 | 50 | 5.0 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 9 | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91503 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 16.0 | none | none | oracle corporation | oracle database server | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-115484 | NOISE | 19 | 0 | 25 | 50 | 7.6 | 12.6 | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114477 | NOISE | 19 | 0 | 25 | 50 | 4.3 | 11.1 | none | progressive robot ltd | hmailserver | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114470 | NOISE | 19 | 0 | 25 | 50 | 5.3 | 4.1 | none | progressive robot ltd | hmailserver | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110975 | NOISE | 19 | 0 | 25 | 50 | 7.4 | 15.7 | none | none | affected product not stated | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116197 | NOISE | 19 | 0 | 25 | 50 | 2.6 | none | edgelesssys | contrast | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115569 | NOISE | 19 | 0 | 25 | 50 | 3.3 | 8.2 | none | fallow-rs, @fallow-cli | fallow-node · fallow-cli · fallow-core | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107692 | NOISE | 19 | 0 | 25 | 50 | 4.8 | 2.7 | none | none | gaijin entertainment | war thunder | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101422 | NOISE | 19 | 12 | 1 | 49 | 8.1 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110011 | NOISE | 19 | 0 | 25 | 50 | 2.7 | 2.5 | none | none | unknown | mb custom post types & custom taxonomies | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-87309 | NOISE | 19 | 12 | 1 | 50 | 8.1 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-95716 | NOISE | 19 | 0 | 25 | 50 | 6.5 | 15.1 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-89419 | NOISE | 19 | 0 | 25 | 50 | 5.0 | 21.1 | none | openstack | ironic | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-34485 | NOISE | 19 | 0 | 25 | 50 | none | nokia | nokia 1830 global express (gx) | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-104949 | NOISE | 19 | 0 | 25 | 50 | 2.3 | 11.4 | none | enterprisedb | warehousepg | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113874 | NOISE | 19 | 5 | 18 | 49 | 8.1 | 25.2 | none | smilecdr | hapi fhir | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-61791 | NOISE | 19 | 1 | 25 | 50 | 7.4 | none | schorschii | oco-server | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113725 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 4.2 | none | none | pypa | virtualenv | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-111184 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 3.5 | none | none | nomachine | nomachine | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-75753 | NOISE | 19 | 7 | 33 | 30 | 5.3 | 8.0 | none | none | asus | router | 2026-10-20 | CISA SSVC: automatable | |||
| CVE-2026-82210 | NOISE | 19 | 0 | 25 | 50 | 8.0 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114474 | NOISE | 19 | 0 | 25 | 50 | 5.9 | 5.3 | none | progressive robot ltd | hmailserver | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-19595 | NOISE | 19 | 0 | 25 | 50 | 6.1 | 1.3 | none | none | zephyrproject | zephyr | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-113610 | NOISE | 19 | 0 | 25 | 50 | 5.4 | none | none | vatesfr | xen-orchestra | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114197 | NOISE | 19 | 6 | 25 | 40 | 8.7 | 1.5 | none | none | mandiant flare | capa | 2026-10-21 | CISA SSVC: total technical impact | Upgrade capa to 10.0.0 or later; releases before 10.0.0 are affected. | ||
| CVE-2026-101482 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 6.5 | none | none | oracle corporation | oracle secure backup | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-111046 | NOISE | 19 | 0 | 25 | 50 | 2.3 | none | none | fossbilling | fossbilling | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101454 | NOISE | 19 | 0 | 25 | 50 | 6.1 | none | oracle corporation | siebel crm development | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101841 | NOISE | 19 | 12 | 1 | 49 | 8.2 | none | oracle corporation | global order promising | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114642 | NOISE | 19 | 0 | 25 | 50 | 8.7 | 10.1 | none | none | traefik | traefik | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to Traefik 2.11.58 or later in the 2.11.x line, or 3.7.14 or later in the 3.x line. | ||
| CVE-2026-79978 | NOISE | 19 | 0 | 25 | 50 | 3.6 | 0.5 | none | zephyrproject | zephyr | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91457 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 5.0 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-83398 | NOISE | 19 | 12 | 1 | 49 | 8.2 | none | oracle corporation | oracle data integrator | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91211 | NOISE | 19 | 13 | 1 | 50 | 8.7 | none | oracle corporation | oracle identity manager connector | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-108833 | NOISE | 19 | 0 | 25 | 50 | none | apache software foundation | apache kylin | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-101791 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 29.2 | none | none | oracle corporation | oracle communications brm – elastic charging engine | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-108780 | NOISE | 19 | 0 | 25 | 50 | none | apache software foundation | apache kylin | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-108121 | NOISE | 19 | 0 | 25 | 50 | 6.9 | 22.3 | none | none | koozali | sme server | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-91093 | NOISE | 19 | 6 | 25 | 40 | 8.5 | 5.5 | none | none | hp inc. | hp one agent software | 2026-10-23 | CISA SSVC: total technical impact | Update HP One Agent to version 1.87.4769.0 or later, per HP security bulletin HPSBHF04150. | ||
| CVE-2026-29001 | NOISE | 19 | 0 | 25 | 50 | 7.2 | 50.2 | none | tastyigniter | tastyigniter | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114198 | NOISE | 19 | 6 | 25 | 40 | 8.7 | 1.5 | none | none | mandiant flare | floss | 2026-10-21 | CISA SSVC: total technical impact | Upgrade floss to version 3.2.0 or later; releases before 3.2.0 are affected. | ||
| CVE-2026-102438 | NOISE | 19 | 6 | 25 | 40 | 8.5 | 1.9 | none | none | asus | armoury crate se | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2024-58393 | NOISE | 19 | 12 | 0 | 50 | 8.2 | none | i-netsolution | readymade unilevel ecommerce mlm | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-79892 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 4.7 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-113713 | NOISE | 19 | 0 | 25 | 50 | 4.4 | none | pypa | virtualenv | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112852 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 17.2 | none | none | themerex group | helion | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-114615 | NOISE | 19 | 0 | 25 | 50 | 7.4 | 2.4 | none | authlib | authlib | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2025-30051 | NOISE | 19 | 0 | 25 | 50 | 6.8 | 0.7 | none | cgm | cgm clininet | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2021-48018 | NOISE | 19 | 0 | 25 | 50 | 7.4 | 33.0 | none | none | vyperlang | vyper | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-113599 | NOISE | 19 | 0 | 25 | 50 | 5.4 | none | none | modoboa | modoboa | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-50056 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 27.6 | none | none | zimbra | zimbra collaboration suite | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-113654 | NOISE | 19 | 0 | 25 | 50 | 5.3 | none | apostrophecms | apostrophe · sanitize-html | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111737 | NOISE | 19 | 0 | 25 | 50 | 3.5 | 8.0 | none | none | unknown | speed optimizer | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-92539 | NOISE | 19 | 0 | 25 | 50 | 6.7 | none | none | grafana | grafana enterprise | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112947 | NOISE | 19 | 0 | 25 | 50 | 6.3 | none | none | vitejs | vite-plus | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-89052 | NOISE | 19 | 0 | 25 | 50 | 5.9 | 14.0 | none | tp-link systems inc. | archer c6 v2 | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111978 | NOISE | 19 | 0 | 25 | 50 | 6.0 | 4.9 | none | none | unknown | givewp | 2026-10-25 | no exploitation evidence in any monitored source | |||
| CVE-2026-91460 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 15.2 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-114490 | NOISE | 19 | 0 | 25 | 50 | 7.8 | 1.1 | none | progressive robot ltd | hmailserver | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112850 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 26.8 | none | none | ancorathemes | your dress | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-85260 | NOISE | 19 | 0 | 25 | 50 | 5.5 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101772 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 30.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-92287 | NOISE | 19 | 0 | 25 | 50 | 11.4 | none | apache software foundation | apache arrow c++ · pyarrow | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101771 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 30.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101768 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 30.4 | none | none | oracle corporation | mysql connectors | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101757 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 4.0 | none | none | oracle corporation | oracle application object library | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101744 | NOISE | 19 | 6 | 25 | 40 | 8.4 | 21.7 | none | none | oracle corporation | oracle agile engineering data management | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-86409 | NOISE | 19 | 0 | 25 | 50 | 15.1 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112188 | NOISE | 19 | 0 | 25 | 50 | 7.1 | none | misp | misp | 2026-10-19 | no exploitation evidence in any monitored source | |||||
| CVE-2026-85313 | NOISE | 19 | 0 | 25 | 50 | 4.3 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91831 | NOISE | 19 | 0 | 25 | 50 | 3.8 | 4.9 | none | none | unknown | subscribe to comments | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-114610 | NOISE | 19 | 0 | 25 | 50 | 6.5 | 23.0 | none | py-pdf | fpdf2 | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-56388 | NOISE | 19 | 0 | 25 | 50 | 20.4 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-79891 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 45.8 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-92209 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 15.3 | none | none | nomachine | nomachine | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-93489 | NOISE | 19 | 6 | 33 | 30 | 8.7 | 13.8 | none | none | asus | router | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-112297 | NOISE | 19 | 0 | 25 | 50 | 4.3 | 16.2 | none | none | ptbsare | anx-calibre-manager | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-112192 | NOISE | 19 | 0 | 25 | 50 | 5.3 | none | none | misp | misp | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115996 | NOISE | 19 | 0 | 25 | 50 | 3.7 | 13.9 | none | none | unitree robotics | unitree go2 | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-91263 | NOISE | 19 | 0 | 25 | 50 | 4.9 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114663 | NOISE | 19 | 6 | 25 | 40 | 8.4 | 7.1 | none | none | vyperlang | vyper | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-113594 | NOISE | 19 | 0 | 25 | 50 | 5.4 | none | none | sharkord | sharkord | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115749 | NOISE | 19 | 0 | 25 | 50 | 3.3 | 12.4 | none | none | hydra-ecosystem | hydra-ray-launcher | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-115657 | NOISE | 19 | 0 | 25 | 50 | 4.8 | 3.4 | none | none | knime | knime analytics platform | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-101390 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 32.5 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101411 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 32.5 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101456 | NOISE | 19 | 0 | 25 | 50 | 6.0 | none | oracle corporation | siebel crm development | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116194 | NOISE | 19 | 0 | 25 | 50 | 6.8 | none | rclone | rclone | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-79704 | NOISE | 19 | 0 | 25 | 50 | 5.4 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101593 | NOISE | 19 | 13 | 1 | 50 | 8.3 | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2022-51024 | NOISE | 19 | 1 | 25 | 50 | 7.5 | none | kareadita | kavita | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114623 | NOISE | 19 | 0 | 25 | 50 | 6.5 | 50.9 | none | none | baserproject | basercms | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-101831 | NOISE | 19 | 12 | 1 | 49 | 8.1 | none | oracle corporation | oracle quality | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115481 | NOISE | 19 | 6 | 25 | 40 | 8.5 | 26.7 | none | none | baserproject | basercms | 2026-10-23 | CISA SSVC: total technical impact | Upgrade to baserCMS 5.3.2 or 5.4.2 or later. | ||
| CVE-2026-113501 | NOISE | 19 | 0 | 25 | 50 | 3.1 | 8.2 | none | none | unknown | litespeed cache | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-19676 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 3.7 | none | none | zephyrproject | zephyr | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-55457 | NOISE | 19 | 0 | 25 | 50 | 7.4 | 19.7 | none | intranda | goobi-viewer-core | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112333 | NOISE | 19 | 0 | 25 | 50 | 5.4 | 3.2 | none | gfi software | gfi archiver | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114617 | NOISE | 19 | 0 | 25 | 50 | 4.2 | 14.0 | none | none | authlib | authlib | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-83393 | NOISE | 19 | 13 | 1 | 49 | 8.5 | none | oracle corporation | oracle product hub | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116166 | NOISE | 19 | 0 | 25 | 50 | 6.8 | none | siyuan-note | siyuan | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115886 | NOISE | 19 | 0 | 25 | 50 | 6.5 | 25.2 | none | mlflow | mlflow | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115885 | NOISE | 19 | 0 | 25 | 50 | 4.1 | 1.4 | none | langchain-ai | langgraph | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115480 | NOISE | 19 | 0 | 25 | 50 | 5.3 | 24.2 | none | baserproject | basercms | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115535 | NOISE | 19 | 0 | 25 | 50 | 2.4 | 11.1 | none | gedelumbung | hospitalmanagement | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-74755 | NOISE | 19 | 0 | 25 | 50 | 9.6 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115376 | NOISE | 19 | 0 | 25 | 50 | 7.7 | 19.5 | none | lxc | incus | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115363 | NOISE | 19 | 0 | 25 | 50 | 3.3 | 2.2 | none | openbao | openbao | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91492 | NOISE | 19 | 6 | 25 | 40 | 8.7 | 15.4 | none | none | oracle corporation | oracle identity manager connector | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91459 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 15.2 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91458 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 2.2 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-114438 | NOISE | 19 | 0 | 25 | 50 | 4.2 | 4.8 | none | red hat | red hat build of keycloak · red hat single sign-on 7 | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114388 | NOISE | 19 | 0 | 25 | 50 | 5.3 | 5.6 | none | chamilo | chamilo-lms | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-81755 | NOISE | 19 | 0 | 25 | 50 | 13.3 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-80463 | NOISE | 19 | 0 | 25 | 50 | 9.6 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-78058 | NOISE | 19 | 0 | 25 | 50 | 22.3 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-66392 | NOISE | 19 | 0 | 25 | 50 | 0.9 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109125 | NOISE | 19 | 0 | 25 | 50 | 5.3 | 2.6 | none | nlnet labs | unbound | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91473 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 3.0 | none | none | oracle corporation | oracle http server | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91419 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 3.7 | none | none | oracle corporation | oracle http server | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-79888 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 40.8 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-79887 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 48.1 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-18748 | NOISE | 19 | 0 | 25 | 50 | 3.5 | 10.1 | none | none | zephyrproject | zephyr | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-105936 | NOISE | 19 | 0 | 25 | 50 | 5.3 | 42.8 | none | none | apache software foundation | apache pulsar | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-91437 | NOISE | 19 | 6 | 25 | 40 | 8.7 | 29.6 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-87388 | NOISE | 19 | 0 | 25 | 50 | 5.3 | none | oracle corporation | jd edwards enterpriseone configurator | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113726 | NOISE | 19 | 0 | 25 | 50 | 7.8 | 13.5 | none | pypa | virtualenv | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-74048 | NOISE | 19 | 0 | 25 | 50 | none | apache software foundation | apache tomcat | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-64945 | NOISE | 19 | 0 | 25 | 50 | none | apache software foundation | apache answer | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-101451 | NOISE | 19 | 13 | 1 | 50 | 8.7 | none | oracle corporation | siebel life sciences | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105933 | NOISE | 19 | 0 | 25 | 50 | 2.3 | 21.7 | none | none | apache software foundation | apache pulsar | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-114665 | NOISE | 19 | 0 | 25 | 50 | 6.5 | none | zhenorzz | goploy | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110010 | NOISE | 19 | 0 | 25 | 50 | 4.8 | 6.2 | none | none | unknown | mb custom post types & custom taxonomies | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114659 | NOISE | 19 | 0 | 25 | 50 | 6.5 | 49.8 | none | none | getgrav | grav-plugin-flex-objects | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-111915 | NOISE | 19 | 0 | 25 | 50 | 5.9 | none | none | purocean | yank note | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-64943 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 8.9 | none | none | apache software foundation | apache answer | 2026-10-19 | CISA SSVC: total technical impact | Upgrade to Apache Answer 2.0.3 or later, which stops full API keys being written to application logs. | ||
| CVE-2026-112161 | NOISE | 19 | 6 | 25 | 40 | 8.5 | 0.1 | none | none | mobatek | mobaxterm | 2026-10-19 | CISA SSVC: total technical impact | Update MobaXterm to version 26.5 (released 11 September 2026) or later. | ||
| CVE-2026-114097 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 4.0 | none | none | jelmer | dulwich | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-79984 | NOISE | 19 | 16 | 30 | 15 | 7.4 | 42.9 | poc | poc_early | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-98883 | NOISE | 19 | 0 | 70 | 5 | 5.3 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-94263 | NOISE | 19 | 0 | 25 | 50 | 4.8 | 9.8 | none | none | unknown | advanced custom fields: extended pro | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-97627 | NOISE | 19 | 6 | 25 | 40 | 8.6 | 21.5 | none | none | atsumi electric co., ltd. | adx5004 · adx5008 · adx404 +7 more | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-113661 | NOISE | 19 | 0 | 25 | 50 | 5.4 | none | none | apostrophecms | apostrophe · sanitize-html | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91059 | NOISE | 19 | 0 | 25 | 50 | 6.8 | none | none | eclipse foundation | eclipse threadx – guix | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96406 | NOISE | 19 | 0 | 25 | 50 | 4.9 | none | none | eclipse foundation | eclipse threadx – usbx | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-92454 | NOISE | 19 | 0 | 25 | 50 | 6.1 | none | none | eclipse foundation | eclipse threadx – guix | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112066 | NOISE | 19 | 0 | 25 | 50 | 7.1 | 30.7 | none | none | typo3 | extension "sgalinski cookie consent" | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-112239 | NOISE | 19 | 0 | 25 | 50 | 7.2 | 30.4 | none | none | typo3 | extension "typo3 ai integration extension" | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101770 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 30.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101431 | NOISE | 19 | 6 | 25 | 40 | 8.7 | 29.5 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-113583 | NOISE | 19 | 0 | 25 | 50 | 6.1 | 20.1 | none | none | cypht-org | cypht | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-99033 | NOISE | 19 | 0 | 70 | 5 | 7.1 | none | linux | linux | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114721 | NOISE | 19 | 0 | 25 | 50 | 3.1 | 21.1 | none | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-101824 | NOISE | 19 | 6 | 25 | 40 | 8.7 | 24.1 | none | none | oracle corporation | document management and collaboration | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101704 | NOISE | 19 | 5 | 25 | 40 | 8.2 | 6.0 | none | none | oracle corporation | oracle concurrent processing | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101700 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 33.5 | none | none | oracle corporation | oracle application object library | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-109931 | NOISE | 19 | 0 | 25 | 50 | 3.7 | 3.6 | none | none | unknown | infility global | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-86611 | NOISE | 19 | 0 | 25 | 50 | 4.3 | none | none | unknown | download manager | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-94262 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 21.0 | none | none | unknown | advanced custom fields: extended pro | 2026-10-23 | CISA SSVC: total technical impact | Update Advanced Custom Fields: Extended and Extended PRO to version 0.9.2.8 or later. | ||
| CVE-2026-113595 | NOISE | 19 | 0 | 25 | 50 | 4.3 | 24.4 | none | none | sharkord | sharkord | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-92183 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 37.4 | none | none | gimp | gimp | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2025-55702 | NOISE | 19 | 6 | 25 | 40 | 8.7 | 25.3 | none | none | apache software foundation | apache traffic server | 2026-10-21 | CISA SSVC: total technical impact | Upgrade to Apache Traffic Server 9.2.16, 10.1.5, or 10.2.1, which fix the issue. | ||
| CVE-2026-112257 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 2.7 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-79985 | NOISE | 19 | 16 | 30 | 15 | 7.4 | 42.8 | poc | poc_early | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-79983 | NOISE | 19 | 16 | 30 | 15 | 7.4 | 42.9 | poc | poc_early | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-84181 | NOISE | 19 | 0 | 25 | 50 | 5.9 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-84176 | NOISE | 19 | 0 | 25 | 50 | 6.5 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112261 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 2.7 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-115627 | NOISE | 18 | 0 | 30 | 40 | 6.0 | none | none | ash-project | ash_postgres | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113652 | NOISE | 18 | 0 | 30 | 40 | 5.6 | none | none | apostrophecms | apostrophe · uploadfs | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91369 | NOISE | 18 | 0 | 30 | 40 | 5.3 | none | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91367 | NOISE | 18 | 0 | 30 | 40 | 6.5 | none | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91366 | NOISE | 18 | 0 | 30 | 40 | 4.7 | none | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113500 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 23.0 | none | none | unknown | litespeed cache | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-111982 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 26.5 | none | none | unknown | user profile builder | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-114145 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 28.4 | none | none | gitpython-developers | gitpython | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-114362 | NOISE | 18 | 0 | 33 | 40 | 6.3 | 14.8 | none | n/a | harnessrouter | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101500 | NOISE | 18 | 3 | 25 | 40 | 6.5 | 7.8 | none | none | oracle corporation | oracle global lifecycle management opatchauto | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-108360 | NOISE | 18 | 0 | 30 | 40 | 6.4 | 12.6 | none | phpoffice | phpspreadsheet | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115416 | NOISE | 18 | 1 | 30 | 40 | 7.7 | none | aws | amazon athena | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116180 | NOISE | 18 | 1 | 30 | 40 | 7.7 | none | none | vllm-project | vllm | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114429 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 23.2 | none | none | unknown | wpvr | 2026-10-24 | CISA SSVC: total technical impact | |||
| CVE-2026-101823 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 26.9 | none | none | oracle corporation | oracle bills of material | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2025-6623 | NOISE | 18 | 0 | 33 | 40 | 4.3 | 12.0 | none | none | wso2 | wso2 api manager · wso2 universal gateway · wso2 traffic manager +3 more | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-75775 | NOISE | 18 | 4 | 33 | 30 | 7.7 | 48.6 | none | none | asus | router | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-101436 | NOISE | 18 | 0 | 30 | 40 | 4.1 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91365 | NOISE | 18 | 0 | 30 | 40 | 5.9 | none | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101437 | NOISE | 18 | 0 | 30 | 40 | 6.6 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101633 | NOISE | 18 | 0 | 33 | 40 | 4.3 | none | none | oracle corporation | mysql router | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114361 | NOISE | 18 | 0 | 33 | 40 | 5.6 | 34.0 | none | none | n/a | harnessrouter | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-101439 | NOISE | 18 | 0 | 30 | 40 | 5.9 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101440 | NOISE | 18 | 0 | 30 | 40 | 5.9 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91467 | NOISE | 18 | 3 | 25 | 40 | 6.6 | 8.4 | none | none | oracle corporation | oracle fusion middleware control | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91405 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 20.5 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-76740 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 29.7 | none | none | hewlett packard enterprise | hpe compute scale-up server 3200 platform · hpe compute scale-up server 3250 platform · hpe superdome flex server +1 more | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-112342 | NOISE | 18 | 0 | 33 | 40 | 7.1 | 18.8 | none | none | tandoor recipes | tandoor recipes | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-101441 | NOISE | 18 | 0 | 30 | 40 | 5.3 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-55459 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 10.3 | none | none | intranda | goobi-viewer-core | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-101698 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 26.9 | none | none | oracle corporation | oracle one-to-one fulfillment | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-42020 | NOISE | 18 | 4 | 13 | 50 | 9.1 | 54.0 | none | totolink | totolink | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114463 | NOISE | 18 | 0 | 33 | 40 | 29.3 | none | nous research | hermes agent | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87301 | NOISE | 18 | 0 | 21 | 50 | 8.4 | none | oracle corporation | oracle vm virtualbox | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-21812 | NOISE | 18 | 0 | 30 | 40 | 2.2 | 1.7 | none | none | hcl software | appscan integration with azure boards for asoc & a360 | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-101739 | NOISE | 18 | 3 | 25 | 40 | 7.0 | 1.9 | none | none | oracle corporation | oracle agile engineering data management | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-115635 | NOISE | 18 | 0 | 30 | 40 | 6.0 | none | none | ash-project | ash_postgres | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116069 | NOISE | 18 | 0 | 30 | 40 | 6.5 | none | albert-weasker | niubigeo | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86415 | NOISE | 18 | 0 | 33 | 40 | 6.4 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-70386 | NOISE | 18 | 0 | 33 | 38 | 8.5 | 68.5 | none | oneplus | oxygenos | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101707 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 26.4 | none | none | oracle corporation | oracle concurrent processing | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-116066 | NOISE | 18 | 0 | 30 | 40 | 6.8 | none | firecrawl | firecrawl | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113728 | NOISE | 18 | 0 | 30 | 40 | 7.5 | 42.4 | none | bulwarkmail | webmail | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115729 | NOISE | 18 | 0 | 30 | 40 | 6.8 | 20.9 | none | pdfme | common | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-40615 | NOISE | 18 | 4 | 13 | 50 | 9.1 | 54.0 | none | totolink | totolink | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115570 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 31.4 | none | none | electron | electron | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-115752 | NOISE | 18 | 0 | 30 | 40 | 4.2 | 6.9 | none | signalk | signalk-server | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65825 | NOISE | 18 | 0 | 30 | 40 | 7.5 | 11.9 | none | none | open-reception | appointment-booking-software | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-74921 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 13.6 | none | none | unknown | document gallery | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-106933 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 6.0 | none | none | unknown | blaze demo importer | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-111936 | NOISE | 18 | 0 | 30 | 40 | 4.3 | none | none | aleksey-hoffman | sigma file manager | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114704 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 35.2 | none | none | christoph vielgrader | relevanssi | 2026-10-24 | CISA SSVC: total technical impact | |||
| CVE-2026-115251 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 6.5 | none | none | unknown | duplicator | 2026-10-25 | CISA SSVC: total technical impact | |||
| CVE-2026-91232 | NOISE | 18 | 11 | 1 | 49 | 9.9 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87332 | NOISE | 18 | 0 | 30 | 40 | 3.0 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-33568 | NOISE | 18 | 4 | 13 | 50 | 9.1 | 63.8 | none | totolink | totolink | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-19741 | NOISE | 18 | 0 | 33 | 40 | 7.5 | 6.4 | none | zephyrproject | zephyr | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-85247 | NOISE | 18 | 0 | 33 | 40 | 5.9 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105311 | NOISE | 18 | 1 | 30 | 40 | 7.7 | none | none | red hat | streamshub console for apache kafka® · streams for apache kafka 2 · streams for apache kafka 3 | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112774 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 42.3 | none | none | craftcms | cms | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-116015 | NOISE | 18 | 0 | 30 | 40 | 4.3 | 12.1 | none | none | yunaiv | yudao-cloud | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-91504 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 14.3 | none | none | oracle corporation | oracle webcenter content | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91496 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 22.6 | none | none | oracle corporation | workflow | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91488 | NOISE | 18 | 3 | 25 | 40 | 7.1 | 2.8 | none | none | oracle corporation | oracle identity manager connector | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91474 | NOISE | 18 | 3 | 25 | 40 | 6.1 | 12.0 | none | none | oracle corporation | peoplesoft enterprise fin common objects brazil | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91423 | NOISE | 18 | 3 | 25 | 40 | 6.0 | 5.0 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-112377 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 7.0 | none | none | ccc-attestation | attested-tls-poc | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-91444 | NOISE | 18 | 3 | 25 | 40 | 6.7 | 1.7 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-115883 | NOISE | 18 | 0 | 30 | 40 | 6.0 | 22.3 | none | none | langchain-ai | langgraph-checkpoint-postgres · langgraph-checkpoint-sqlite | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-113682 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 46.5 | none | none | networknt | light-4j | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-116177 | NOISE | 18 | 1 | 30 | 40 | 7.5 | none | vllm-project | vllm | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114047 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 4.7 | none | none | freerdp | freerdp | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-28763 | NOISE | 18 | 4 | 13 | 50 | 9.1 | 54.0 | none | totolink | totolink | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101806 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 20.7 | none | none | oracle corporation | mysql connectors | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-41222 | NOISE | 18 | 4 | 13 | 50 | 9.1 | 54.0 | none | totolink | totolink | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-84747 | NOISE | 18 | 0 | 33 | 40 | 11.3 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2025-65200 | NOISE | 18 | 0 | 30 | 40 | 5.4 | 7.6 | none | none | n/a | n/a | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-86146 | NOISE | 18 | 0 | 33 | 40 | 9.8 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101416 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 12.7 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-42019 | NOISE | 18 | 4 | 13 | 50 | 9.1 | 54.0 | none | totolink | totolink | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91359 | NOISE | 18 | 0 | 30 | 40 | 5.3 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91360 | NOISE | 18 | 0 | 30 | 40 | 6.5 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91362 | NOISE | 18 | 0 | 30 | 40 | 5.3 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110491 | NOISE | 18 | 8 | 25 | 30 | 7.5 | 44.2 | none | none | kiloview | e3 firmware | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-107861 | NOISE | 18 | 9 | 25 | 30 | 9.9 | 43.3 | none | none | kiloview | e3 firmware | 2026-10-22 | CISA SSVC: total technical impact | Update Kiloview E3 firmware to V1.30 or later, which is unaffected. | ||
| CVE-2026-91363 | NOISE | 18 | 0 | 30 | 40 | 3.7 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101694 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 41.9 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-17557 | NOISE | 18 | 0 | 30 | 40 | 6.5 | 16.5 | none | none | red hat | red hat openshift ai (rhoai) | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-97328 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 6.4 | none | none | unknown | webp express | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-112822 | NOISE | 18 | 3 | 25 | 40 | 8.5 | none | none | amentotech | workreap core | 2026-10-22 | no exploitation evidence in any monitored source | Update the Workreap Core plugin to version 3.4.4 or later. | |||
| CVE-2026-91368 | NOISE | 18 | 0 | 30 | 40 | 4.1 | none | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91372 | NOISE | 18 | 0 | 30 | 40 | 3.3 | none | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101719 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 26.0 | none | none | oracle corporation | oracle agile plm | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-111971 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 4.7 | none | none | unknown | photo engine (media organizer & lightroom) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-78392 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 7.8 | none | none | unknown | link library | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-91224 | NOISE | 18 | 11 | 1 | 49 | 9.9 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111438 | NOISE | 18 | 3 | 25 | 40 | 6.5 | 28.4 | none | none | opengauss-server | opengauss-server | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-112303 | NOISE | 18 | 0 | 30 | 40 | 4.3 | none | none | gdevelop | gdevelop | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-78801 | NOISE | 18 | 0 | 33 | 40 | 4.3 | none | none | n/a | n/a | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114603 | NOISE | 18 | 0 | 33 | 40 | 5.3 | none | open-telemetry | opentelemetry-python | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-54238 | NOISE | 18 | 0 | 30 | 40 | 3.1 | 10.6 | none | supabase | realtime | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-54532 | NOISE | 18 | 0 | 30 | 40 | 6.9 | 8.2 | none | cloudpirates-io | helm-charts | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111899 | NOISE | 18 | 0 | 30 | 40 | 4.3 | none | none | tombursch | kitchenowl | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2025-7043 | NOISE | 18 | 0 | 33 | 40 | 5.4 | none | wso2 | wso2 api manager · wso2 universal gateway · wso2 api control plane +1 more | 2026-10-19 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101444 | NOISE | 18 | 0 | 30 | 40 | 5.5 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101532 | NOISE | 18 | 0 | 33 | 40 | 7.2 | none | oracle corporation | oracle edi gateway | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101533 | NOISE | 18 | 0 | 33 | 40 | 6.6 | none | oracle corporation | oracle edi gateway | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-57210 | NOISE | 18 | 0 | 30 | 40 | 7.0 | 23.3 | none | dadrus | heimdall | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111440 | NOISE | 18 | 3 | 25 | 40 | 7.0 | 11.9 | none | none | opengauss-server | opengauss-connector-jdbc | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-112290 | NOISE | 18 | 0 | 33 | 40 | 4.7 | none | none | mi6 | intelligence community ui kit canary web components | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-85245 | NOISE | 18 | 0 | 30 | 40 | 5.9 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114041 | NOISE | 18 | 0 | 33 | 40 | 6.5 | 24.1 | none | freerdp | freerdp | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-109927 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 7.2 | none | none | unknown | hipaa forms | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-114090 | NOISE | 18 | 3 | 25 | 40 | 7.1 | 9.9 | none | none | trigger.dev | cli-v3 | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-115863 | NOISE | 18 | 0 | 33 | 40 | 7.6 | 22.4 | none | connman | connman | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116016 | NOISE | 18 | 0 | 30 | 40 | 7.1 | 16.9 | none | yunaiv | yudao-cloud | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116018 | NOISE | 18 | 0 | 30 | 40 | 4.3 | 11.5 | none | onearmy | community-platform | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91251 | NOISE | 18 | 11 | 1 | 49 | 9.9 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114219 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 18.5 | none | none | newtype infortech | nt oneapp | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-103314 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 17.1 | none | none | red hat | red hat advanced cluster security for kubernetes 4.11 · red hat advanced cluster security 4 | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-111088 | NOISE | 18 | 0 | 33 | 40 | 6.5 | none | stormshield | stormshield network security | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-54711 | NOISE | 18 | 0 | 30 | 40 | 2.4 | 4.7 | none | aiven-open | pghoard | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115845 | NOISE | 18 | 0 | 30 | 40 | 6.4 | 23.1 | none | aws | aws mcp server | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91449 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 15.4 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91450 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 22.7 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-12254 | NOISE | 18 | 0 | 33 | 40 | 6.4 | 14.1 | none | none | netskope inc. | netskope client | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-101443 | NOISE | 18 | 0 | 30 | 40 | 6.5 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2025-7203 | NOISE | 18 | 0 | 33 | 40 | 4.9 | 4.1 | none | none | wso2 | wso2 universal gateway · wso2 traffic manager · wso2 api control plane +5 more | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-115411 | NOISE | 18 | 0 | 30 | 40 | 5.0 | none | crawlseo | crawlseo | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101442 | NOISE | 18 | 0 | 30 | 40 | 3.1 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114065 | NOISE | 18 | 0 | 30 | 40 | 6.5 | none | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112288 | NOISE | 18 | 0 | 30 | 40 | 3.3 | none | none | krayin | laravel-crm | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113469 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 4.2 | none | none | stormshield | stormshield network security | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-114656 | NOISE | 18 | 0 | 33 | 40 | 7.5 | 5.2 | none | traefik | traefik | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101736 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 27.8 | none | none | oracle corporation | primavera unifier | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101410 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 32.2 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-113727 | NOISE | 18 | 0 | 30 | 40 | 7.4 | 40.0 | none | none | openchoreo | openchoreo | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-115494 | NOISE | 18 | 0 | 33 | 40 | 5.3 | none | none | knime | knime business hub | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114091 | NOISE | 18 | 0 | 30 | 40 | 5.3 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2025-13173 | NOISE | 18 | 0 | 33 | 40 | 6.5 | 3.7 | none | none | wso2 | wso2 api control plane · wso2 universal gateway · wso2 api manager +5 more | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-40627 | NOISE | 18 | 4 | 13 | 50 | 9.1 | 63.8 | none | totolink | totolink | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101445 | NOISE | 18 | 0 | 30 | 40 | 3.6 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91406 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 29.6 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-114131 | NOISE | 18 | 0 | 33 | 40 | 6.5 | 20.4 | none | nuxt | nuxt | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-102786 | NOISE | 18 | 5 | 13 | 50 | 8.6 | 17.8 | none | phoca.cz | phoca gallery extension for joomla | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91484 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 1.2 | none | none | oracle corporation | oracle java se | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-114486 | NOISE | 18 | 0 | 33 | 40 | none | devolutions | server | 2026-10-22 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-101826 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 26.9 | none | none | oracle corporation | oracle hcm common architecture | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101825 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 26.9 | none | none | oracle corporation | oracle hcm common architecture | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101820 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 26.9 | none | none | oracle corporation | oracle general ledger | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101746 | NOISE | 18 | 4 | 25 | 40 | 7.3 | 12.1 | none | none | oracle corporation | oracle agile engineering data management | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101723 | NOISE | 18 | 3 | 25 | 40 | 6.7 | 1.6 | none | none | oracle corporation | oracle agile plm mcad connector | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101712 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 29.8 | none | none | oracle corporation | oracle payroll | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101711 | NOISE | 18 | 3 | 25 | 40 | 6.6 | 31.5 | none | none | oracle corporation | oracle payroll | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101710 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 23.0 | none | none | oracle corporation | oracle payroll | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101708 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 29.8 | none | none | oracle corporation | oracle payroll | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101786 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 39.3 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-105926 | NOISE | 18 | 0 | 30 | 40 | 5.3 | 33.9 | none | apache software foundation | apache pulsar | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114137 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 40.7 | none | none | encode | django-rest-framework | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-110744 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 30.1 | none | none | red hat | multicluster global hub | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-113499 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 23.0 | none | none | unknown | litespeed cache | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-116187 | NOISE | 18 | 0 | 30 | 40 | 5.0 | none | none | rclone | rclone | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116185 | NOISE | 18 | 0 | 33 | 40 | 5.0 | none | openremote | core | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116184 | NOISE | 18 | 0 | 33 | 40 | 2.1 | none | openremote | core | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116014 | NOISE | 18 | 0 | 8 | 65 | 8.1 | 37.1 | none | open62541 | open62541 | 2026-10-24 | no exploitation evidence in any monitored source | Upgrade open62541 to 1.5.7 or later; versions 1.5.0 through 1.5.6 are affected. | |||
| CVE-2026-75525 | NOISE | 18 | 0 | 30 | 40 | 5.3 | 1.9 | none | open-reception | appointment-booking-software | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-55606 | NOISE | 18 | 0 | 33 | 40 | 6.5 | 31.6 | none | openwrt | odhcpd | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112293 | NOISE | 18 | 0 | 30 | 40 | 5.4 | none | none | boxyhq | saas-starter-kit | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115417 | NOISE | 18 | 0 | 30 | 40 | 7.5 | 28.4 | none | aws | aws-c-mqtt | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-97631 | NOISE | 18 | 5 | 33 | 27 | 9.5 | none | tianocore | edk2 | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-94502 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 23.0 | none | none | silicon labs | emberznet | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-92709 | NOISE | 18 | 12 | 33 | 15 | 8.1 | none | rsyslog | rsyslog | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114730 | NOISE | 18 | 0 | 30 | 40 | 7.2 | 22.8 | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113493 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 23.2 | none | none | unknown | geodirectory | 2026-10-24 | CISA SSVC: total technical impact | |||
| CVE-2026-113673 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 48.1 | none | none | unknown | geodirectory | 2026-10-24 | CISA SSVC: total technical impact | |||
| CVE-2026-100420 | NOISE | 18 | 0 | 30 | 40 | 6.8 | 4.3 | none | tp-link systems inc. | deco be63 v2.0 | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91466 | NOISE | 18 | 3 | 25 | 40 | 6.4 | 14.9 | none | none | oracle corporation | peoplesoft enterprise fin common objects argentina | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-113597 | NOISE | 18 | 0 | 33 | 40 | 5.4 | none | none | blinkospace | blinko | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114084 | NOISE | 18 | 1 | 30 | 40 | 7.7 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114081 | NOISE | 18 | 1 | 30 | 40 | 7.7 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-95711 | NOISE | 18 | 3 | 25 | 40 | 7.1 | 14.7 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-95714 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 24.3 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-101519 | NOISE | 18 | 0 | 33 | 40 | 7.2 | none | oracle corporation | oracle edi gateway | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101498 | NOISE | 18 | 12 | 0 | 49 | 8.1 | none | oracle corporation | oracle trusted answer search | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109936 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 20.5 | none | none | unknown | otter blocks | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-111966 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 23.2 | none | none | unknown | user profile builder | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-86467 | NOISE | 18 | 0 | 30 | 40 | 6.3 | none | apache software foundation | apache airflow amazon provider | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-94264 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 23.2 | none | none | unknown | advanced custom fields: extended pro | 2026-10-23 | CISA SSVC: total technical impact | |||
| CVE-2026-16460 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 0.1 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 8 · red hat enterprise linux 9 +2 more | 2026-10-19 | CISA SSVC: total technical impact | |||
| CVE-2026-112308 | NOISE | 18 | 1 | 30 | 40 | 7.4 | none | none | crewaiinc | crewai-tools | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105935 | NOISE | 18 | 0 | 30 | 40 | 4.9 | 33.7 | none | none | apache software foundation | apache pulsar | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-113461 | NOISE | 18 | 3 | 25 | 40 | 5.2 | 1.8 | none | none | checkmk gmbh | checkmk | 2026-10-21 | CISA SSVC: total technical impact | |||
| CVE-2026-101503 | NOISE | 18 | 11 | 0 | 49 | 9.9 | none | oracle corporation | oracle trusted answer search | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115253 | NOISE | 18 | 4 | 25 | 40 | 7.3 | 2.6 | none | none | watchguard | watchguard agent | 2026-10-22 | CISA SSVC: total technical impact | |||
| CVE-2026-101816 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 39.3 | none | none | oracle corporation | oracle product hub | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101812 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 20.6 | none | none | oracle corporation | oracle complex maintenance, repair and overhaul | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91433 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 37.1 | none | none | oracle corporation | siebel apps – field service | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-91434 | NOISE | 18 | 3 | 25 | 40 | 6.7 | 1.7 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-107887 | NOISE | 18 | 0 | 33 | 40 | 5.4 | 3.4 | none | none | unknown | advanced twenty seventeen | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-101689 | NOISE | 18 | 0 | 33 | 40 | 7.7 | 29.8 | none | none | oracle corporation | oracle e-business suite integrated soa gateway | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101829 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 23.5 | none | none | oracle corporation | oracle mobile application server | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101827 | NOISE | 18 | 3 | 25 | 40 | 7.1 | 21.7 | none | none | oracle corporation | oracle hcm common architecture | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101800 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 20.6 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101797 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 22.6 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101796 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 22.6 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101795 | NOISE | 18 | 3 | 25 | 40 | 6.7 | 4.5 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-79979 | NOISE | 18 | 0 | 33 | 40 | 7.8 | 1.0 | none | zephyrproject | zephyr | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91446 | NOISE | 18 | 3 | 25 | 40 | 6.7 | 1.7 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101705 | NOISE | 18 | 4 | 25 | 40 | 7.7 | 24.5 | none | none | oracle corporation | oracle common applications | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101703 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 26.9 | none | none | oracle corporation | pasta | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101699 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 29.8 | none | none | oracle corporation | oracle one-to-one fulfillment | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-101696 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 22.3 | none | none | oracle corporation | oracle application object library | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-56834 | NOISE | 18 | 0 | 30 | 40 | 7.5 | 30.9 | none | mervinpraison | praisonai | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57114 | NOISE | 18 | 0 | 30 | 40 | 7.2 | 8.2 | none | mervinpraison | praisonai | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57209 | NOISE | 18 | 0 | 30 | 40 | 7.0 | 26.7 | none | dadrus | heimdall | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101632 | NOISE | 18 | 0 | 33 | 40 | 4.3 | none | none | oracle corporation | mysql router | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105298 | NOISE | 18 | 0 | 30 | 40 | 6.3 | 36.9 | none | none | cloudflare | https://github.com/cloudflare/pingora | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-65824 | NOISE | 18 | 0 | 30 | 40 | 7.4 | 16.6 | none | open-reception | appointment-booking-software | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-41223 | NOISE | 18 | 4 | 13 | 50 | 9.1 | 54.0 | none | totolink | totolink | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91347 | NOISE | 17 | 8 | 1 | 50 | 8.5 | none | oracle corporation | isupport | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114096 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | jelmer | dulwich | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101536 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle cost management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116094 | NOISE | 17 | 1 | 25 | 40 | 7.3 | none | n/a | eyoucms | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-75508 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | graphql-python | graphql-core | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101540 | NOISE | 17 | 1 | 25 | 40 | 7.7 | none | oracle corporation | oracle capacity | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101541 | NOISE | 17 | 1 | 25 | 40 | 7.7 | none | oracle corporation | oracle capacity | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114605 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | rthalley | dnspython | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101543 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle capacity | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83404 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | mysql connectors | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101452 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | oracle autonomous health framework | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101546 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle materials requirement planning | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87315 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116062 | NOISE | 17 | 1 | 25 | 40 | 7.3 | none | sourcecodester | performance indicator system | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115355 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | lepture | mistune | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116061 | NOISE | 17 | 1 | 25 | 40 | 7.3 | none | sourcecodester | performance indicator system | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101494 | NOISE | 17 | 1 | 25 | 40 | 7.7 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-78164 | NOISE | 17 | 14 | 25 | 15 | 8.2 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: automatable | Upgrade to 4.23.0; on the 4.22.x stream upgrade to 4.22.1 and on the 4.18.x stream to 4.18.5. The 4.14.x and earlier streams are end-of-life and will not be fixed. | |||
| CVE-2026-87363 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle payroll | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87310 | NOISE | 17 | 9 | 1 | 50 | 8.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101504 | NOISE | 17 | 1 | 25 | 40 | 7.6 | none | oracle corporation | oracle trusted answer search | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101506 | NOISE | 17 | 1 | 25 | 40 | 7.7 | none | oracle corporation | oracle trusted answer search | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101833 | NOISE | 17 | 1 | 25 | 40 | 7.6 | none | oracle corporation | oracle shipping execution | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101835 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle shipping execution | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115969 | NOISE | 17 | 1 | 25 | 40 | 7.3 | 71.0 | none | travisun | opptrix | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114098 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | jelmer | dulwich | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91288 | NOISE | 17 | 1 | 25 | 40 | 7.4 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101837 | NOISE | 17 | 1 | 25 | 40 | 7.7 | none | oracle corporation | oracle shipping execution | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101477 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | oracle autonomous health framework | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101478 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | oracle autonomous health framework | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101421 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91568 | NOISE | 17 | 1 | 25 | 40 | 7.7 | none | none | oracle corporation | oracle database server | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-60662 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87313 | NOISE | 17 | 9 | 1 | 49 | 8.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87314 | NOISE | 17 | 1 | 25 | 40 | 7.4 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101847 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle bills of material | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101849 | NOISE | 17 | 1 | 25 | 40 | 7.6 | none | oracle corporation | installed base | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114059 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | arcadedata | arcadedb | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87312 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87316 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101535 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle sales foundation | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101566 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | oracle application object library | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101604 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle communications unified inventory management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87356 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | applications platform engineering | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111398 | NOISE | 17 | 1 | 25 | 40 | 7.7 | none | none | pt norther lights production | mapsvg | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87359 | NOISE | 17 | 9 | 1 | 49 | 8.8 | none | oracle corporation | oracle service bus | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91253 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91270 | NOISE | 17 | 9 | 1 | 49 | 8.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91272 | NOISE | 17 | 1 | 25 | 40 | 7.4 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83367 | NOISE | 17 | 1 | 25 | 40 | 7.4 | none | oracle corporation | oracle shipping execution | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115723 | NOISE | 17 | 0 | 28 | 40 | 7.4 | 35.9 | none | none | davenardella | snap7 | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-111100 | NOISE | 17 | 7 | 25 | 30 | 5.3 | 32.7 | none | none | kiloview | e3 firmware | 2026-10-22 | CISA SSVC: automatable | |||
| CVE-2026-10141 | NOISE | 17 | 7 | 25 | 30 | 9.1 | 20.4 | none | none | totolink | totolink | 2026-10-20 | CISA SSVC: total technical impact | |||
| CVE-2026-83370 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | sourcing | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101594 | NOISE | 17 | 9 | 1 | 49 | 8.8 | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116189 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | rclone | rclone | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2021-48013 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | weaver network co., ltd. | e-cology | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-56386 | NOISE | 17 | 1 | 25 | 40 | 7.5 | 53.8 | none | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-115323 | NOISE | 17 | 1 | 25 | 40 | 7.3 | none | evershopcommerce | evershop | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-19677 | NOISE | 17 | 10 | 18 | 30 | 9.3 | 44.7 | none | onphase | onphase forms | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to 11.0.17, which removes the unauthenticated registration endpoint, sandboxes rules, and disables the /service Document Service endpoint by default. | |||
| CVE-2026-102499 | NOISE | 17 | 1 | 25 | 40 | 7.7 | none | none | unknown | modern events calendar lite · modern event calendar pro | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101434 | NOISE | 17 | 1 | 25 | 40 | 7.6 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101603 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle communications unified inventory management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101598 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | oracle vm virtualbox | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101641 | NOISE | 17 | 1 | 25 | 40 | 7.6 | none | none | oracle corporation | oracle report manager | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101457 | NOISE | 17 | 9 | 0 | 49 | 8.8 | none | oracle corporation | siebel apps – life sciences | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91337 | NOISE | 17 | 1 | 25 | 40 | 7.4 | none | oracle corporation | iprocurement | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101409 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101599 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle vm virtualbox | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-88901 | NOISE | 17 | 14 | 25 | 15 | 8.2 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: automatable | Upgrade to Apache Camel 4.23.0; 4.18.x LTS users to 4.18.5 and 4.22.x LTS users to 4.22.1. The 4.14.x and earlier streams are end-of-life and will not be fixed. | |||
| CVE-2026-91229 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101552 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle application object library | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91321 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | iprocurement | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91242 | NOISE | 17 | 1 | 25 | 40 | 7.4 | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101531 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2021-48017 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | orbiteam | bscw server | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91315 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2021-48015 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | erzhongxmu | jeewms | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2019-25779 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | woothemes | diarise | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-102486 | NOISE | 17 | 1 | 25 | 40 | 7.5 | 54.4 | none | ntpsec | ntpsec | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91314 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91308 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91307 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91306 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2018-25439 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | metinfo | metinfo | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101551 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle applications manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2018-25438 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | intermesh | group-office | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101549 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | oracle application testing suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105044 | NOISE | 17 | 3 | 13 | 50 | 8.5 | 60.4 | none | qingteng | host adaptive security platform | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101556 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle payroll | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91311 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2017-20287 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | javo themes | javo spot | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91237 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91304 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115392 | NOISE | 17 | 2 | 25 | 40 | 7.9 | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101387 | NOISE | 17 | 1 | 25 | 40 | 7.6 | none | oracle corporation | oracle capacity | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101555 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle payroll | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91668 | NOISE | 17 | 9 | 1 | 49 | 8.8 | none | oracle corporation | oracle data integrator | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91226 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91310 | NOISE | 17 | 9 | 1 | 49 | 8.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101562 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle agile plm | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101527 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | oracle enterprise manager base platform | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91328 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91327 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101554 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle payroll | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91325 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101525 | NOISE | 17 | 9 | 1 | 49 | 8.8 | none | oracle corporation | oracle enterprise manager for siebel | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91227 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87296 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | oracle corporation | oracle access manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83366 | NOISE | 17 | 1 | 25 | 40 | 7.4 | none | oracle corporation | oracle shipping execution | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114122 | NOISE | 16 | 0 | 25 | 40 | 3.9 | 3.1 | none | electron | electron | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112868 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 11.4 | none | none | h5p | h5p | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-111956 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | unknown | wholesalex | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111947 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | unknown | pricing table wordpress plugin | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114127 | NOISE | 16 | 0 | 25 | 40 | 2.3 | 24.8 | none | withastro | astro | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110651 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | none | unknown | swift performance lite | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110514 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | none | unknown | wpzoom portfolio lite | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112179 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 22.3 | none | none | misp | misp | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-107790 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | none | unknown | hirezoot | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107788 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | unknown | smartyparcel | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114133 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 6.7 | none | nuxt | nuxt | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114491 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 16.2 | none | bpampuch | pdfmake | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-92202 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 18.8 | none | luxion | keyshot | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-92203 | NOISE | 16 | 0 | 25 | 40 | 7.7 | 33.7 | none | airbyte | airbyte | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-92210 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 24.5 | none | nomachine | nomachine | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116058 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | alfresco | activiti | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112381 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 28.4 | none | none | apache software foundation | apache traffic server | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-114136 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 26.1 | none | encode | django-rest-framework | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112214 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 7 · red hat enterprise linux 8 +1 more | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112844 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 9.9 | none | none | arraytics | wp event solution | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-106017 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 8.7 | none | none | openvpn | openvpn 3 core library | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114377 | NOISE | 16 | 0 | 25 | 40 | 3.8 | 32.9 | none | leomoon-studios | wiki-go | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114379 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 18.6 | none | ekkolearnai | ekko-studio | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114380 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 10.5 | none | itsourcecode | online cake ordering system | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114731 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 36.3 | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114732 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 28.4 | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114221 | NOISE | 16 | 0 | 25 | 40 | 7.4 | 25.4 | none | newtype infortech | nt oneapp | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114222 | NOISE | 16 | 0 | 25 | 40 | 6.2 | 3.4 | none | newtype infortech | nt oneapp | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111847 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 2.9 | none | none | kings plugins | marketking | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-112867 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 2.4 | none | none | h5p | h5p | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114458 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 22.6 | none | none | pbuchbinder | mod_qos | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2017-20288 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | qcubed | qcubed | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2017-20290 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | discourse | discourse | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-82987 | NOISE | 16 | 0 | 25 | 40 | 20.1 | none | viewsonic | vcast | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115327 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | cesnet | libyang | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115333 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 29.7 | none | none | uselotus | lotus | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-115246 | NOISE | 16 | 0 | 25 | 40 | 3.5 | none | subhajitkhan | online-clinic-management-system | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114485 | NOISE | 16 | 0 | 25 | 40 | none | devolutions | server | 2026-10-22 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-114487 | NOISE | 16 | 0 | 25 | 40 | none | devolutions | server | 2026-10-22 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-115450 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | marcoscamara01 | ecommerce template | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115453 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | marcoscamara01 | ecommerce template | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-77156 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 28.2 | none | checkmarx | github.com/checkmarx/ast-cli | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-77157 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 3.6 | none | checkmarx | github.com/checkmarx/ast-cli | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113875 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 19.2 | none | smilecdr | hapi fhir | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115350 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | lepture | mistune | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115380 | NOISE | 16 | 0 | 25 | 40 | 4.0 | none | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115383 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115391 | NOISE | 16 | 0 | 25 | 40 | 5.8 | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115393 | NOISE | 16 | 0 | 25 | 40 | 3.8 | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115395 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 1.9 | none | nationalsecurityagency | ghidra | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115396 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 1.9 | none | nationalsecurityagency | ghidra | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110008 | NOISE | 16 | 0 | 25 | 40 | 4.2 | none | none | @fastify/oauth2 | @fastify/oauth2 | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82425 | NOISE | 16 | 0 | 25 | 40 | 3.6 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-95720 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 4.1 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-112332 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 49.8 | none | gdatasoftwareag | motornet | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115485 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 9.8 | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-59188 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 4.1 | none | part-db | part-db-server | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-86018 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 19.4 | none | part-db | part-db-server | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-86019 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 16.1 | none | part-db | part-db-server | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-25716 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 7.8 | none | hallo welt! gmbh | bluespice | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-89312 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 19.8 | none | eclipse foundation | eclipse keypont – gose | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-89314 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 16.6 | none | eclipse foundation | eclipse keypont – gose | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-56838 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 3.8 | none | mervinpraison | praisonai | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57142 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 3.8 | none | mervinpraison | praisonai | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93627 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 18.8 | none | zimbra | zimbra collaboration suite | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93628 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 18.8 | none | zimbra | zimbra collaboration suite | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91615 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | none | oracle corporation | oracle database server | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93629 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 18.8 | none | zimbra | zimbra collaboration suite | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91613 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | none | oracle corporation | oracle communications unified inventory management | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93630 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 21.2 | none | zimbra | zimbra collaboration suite | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93631 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 3.7 | none | zimbra | zimbra collaboration suite | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93633 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 6.7 | none | zimbra | zimbra collaboration suite | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93634 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 12.6 | none | zimbra | zimbra collaboration suite | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93636 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 15.1 | none | zimbra | zimbra collaboration suite | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93638 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 11.2 | none | zimbra | zimbra collaboration suite | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2025-45528 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | n/a | n/a | 2026-10-23 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115810 | NOISE | 16 | 0 | 25 | 40 | 7.7 | 15.5 | none | tandoorrecipes | recipes | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-60453 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115572 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 31.2 | none | py-pdf | pypdf | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115580 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 34.9 | none | py-pdf | pypdf | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115585 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 34.9 | none | py-pdf | pypdf | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115796 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 5.0 | none | tenda | f6 | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115797 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 10.0 | none | tenda | f6 | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-60743 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116017 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 13.4 | none | xinnan-tech | xiaozhi-esp32-server | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-60745 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116020 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 7.6 | none | bookstackapp | bookstack | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115999 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 17.5 | none | mansi-k | restaurant_ims | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116004 | NOISE | 16 | 0 | 25 | 40 | 3.5 | 9.6 | none | onyx-dot-app | onyx | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116006 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 32.2 | none | yunaiv, zhijiantianya | ruoyi-vue-pro | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114742 | NOISE | 16 | 0 | 25 | 40 | 2.7 | 2.8 | none | none | unknown | wpvr | 2026-10-25 | no exploitation evidence in any monitored source | |||
| CVE-2026-116048 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 16.8 | none | krupalshah | employeerecruitmentsystem | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-60746 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | oracle order management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116050 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 16.8 | none | krupalshah | employee recruitment system | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116071 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | rotki | rotki | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116073 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | leon-ai | leon | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116148 | NOISE | 16 | 0 | 25 | 40 | 3.6 | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116152 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116153 | NOISE | 16 | 0 | 25 | 40 | 2.5 | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116160 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116196 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | rclone | rclone | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116198 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | grokability | snipe-it | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116200 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | grokability | snipe-it | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116202 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | yeswiki | yeswiki | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-60876 | NOISE | 16 | 0 | 25 | 40 | 4.2 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-60878 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-60887 | NOISE | 16 | 0 | 25 | 40 | 3.8 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-60964 | NOISE | 16 | 0 | 25 | 40 | 1.9 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83358 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle hrms (norway) | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83359 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle hrms (india) | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91393 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | none | oracle corporation | siebel crm end user | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-83360 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle hrms (republic of korea) | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83374 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-85317 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-85300 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-85301 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112183 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | none | misp | misp | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112180 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 24.8 | none | none | misp | misp | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-112270 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | sgl-project | sglang | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112103 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | f3-factory | fatfree-core | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87387 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | jd edwards enterpriseone homebuilder | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87386 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | jd edwards enterpriseone general ledger | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87385 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | oracle corporation | jd edwards enterpriseone human resources management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87384 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | jd edwards enterpriseone human resources management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87339 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | oracle corporation | siebel crm integration | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87340 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87381 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87380 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | jd edwards enterpriseone sales order entry | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87379 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | oracle corporation | webcenter content: imaging | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87342 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87378 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | webcenter content: imaging | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109831 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 5.4 | none | none | gnu project | unrtf | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-87377 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | oracle corporation | webcenter content: imaging | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87353 | NOISE | 16 | 0 | 25 | 40 | 4.5 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87354 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | oracle corporation | oracle timesten in-memory database | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87355 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87357 | NOISE | 16 | 0 | 25 | 40 | 7.2 | none | oracle corporation | order capture | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113598 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | modoboa | modoboa | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-83388 | NOISE | 16 | 0 | 25 | 40 | 2.2 | none | oracle corporation | oracle applications manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83389 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle hrms (uk) | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83391 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle hrms (us) | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-60809 | NOISE | 16 | 0 | 25 | 40 | 4.2 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83406 | NOISE | 16 | 0 | 25 | 40 | 6.7 | none | oracle corporation | oracle communications billing and revenue management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87255 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | oracle java se | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87290 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87293 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle java se | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87294 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87295 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle hrms (india) | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87297 | NOISE | 16 | 0 | 25 | 40 | 6.7 | none | oracle corporation | oracle communications billing and revenue management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-79981 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 2.1 | none | zephyrproject | zephyr | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87320 | NOISE | 16 | 0 | 25 | 40 | 6.7 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87321 | NOISE | 16 | 0 | 25 | 40 | 6.4 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87323 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87324 | NOISE | 16 | 0 | 25 | 40 | 6.4 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87326 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87327 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87329 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87338 | NOISE | 16 | 0 | 25 | 40 | 6.9 | none | oracle corporation | siebel crm integration | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112310 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | docling-project | docling-core | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112275 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | netpbm | netpbm | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111939 | NOISE | 16 | 0 | 25 | 40 | 4.6 | none | none | frappe | helpdesk | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112262 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | risingwavelabs | risingwave | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101706 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 29.8 | none | none | oracle corporation | oracle one-to-one fulfillment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101697 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 15.9 | none | none | oracle corporation | oracle one-to-one fulfillment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113667 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | apostrophecms, @apostrophecms | apostrophe · form · login-hcaptcha +1 more | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101448 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101388 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101386 | NOISE | 16 | 0 | 25 | 40 | 4.2 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101385 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101383 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101382 | NOISE | 16 | 0 | 25 | 40 | 4.2 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101381 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101372 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101371 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101370 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101369 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101368 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101367 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101365 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101364 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101363 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101362 | NOISE | 16 | 0 | 25 | 40 | 6.9 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101361 | NOISE | 16 | 0 | 25 | 40 | 4.2 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109576 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 1.9 | none | hms networks | peak-system device driver setup · pcan windows can device drivers | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107928 | NOISE | 16 | 0 | 25 | 40 | 16.7 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2014-125132 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 10.8 | none | jason newman | blogroll fun | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2012-20005 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 10.8 | none | łukasz więcek | socialfit | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2016-20102 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 10.8 | none | none | javamelody | javamelody | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-115382 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 19.9 | none | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-113670 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | apostrophecms | apostrophe | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113659 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | apostrophecms | apostrophe | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112941 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | tox-dev | filelock | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-34484 | NOISE | 16 | 0 | 25 | 40 | none | nokia | nokia 1830 global express (gx) | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-112785 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | opencats | opencats | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91475 | NOISE | 16 | 0 | 25 | 40 | 6.6 | 2.3 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91471 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 8.2 | none | none | oracle corporation | peoplesoft enterprise cc common application objects | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91530 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | none | oracle corporation | oracle goldengate | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112840 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | brainstorm force | surecart | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101642 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | oracle corporation | oracle report manager | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113600 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 27.2 | none | none | fatfreecrm | fat_free_crm | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101398 | NOISE | 16 | 0 | 25 | 40 | 7.6 | 25.9 | none | none | oracle corporation | oracle capacity | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101397 | NOISE | 16 | 0 | 25 | 40 | 2.2 | 19.7 | none | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101639 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | oracle corporation | oracle marketing | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101637 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101624 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113649 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 22.3 | none | none | apostrophecms, @apostrophecms | apostrophe · import-export | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101622 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101619 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112823 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | wp user manager | wp user manager | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115378 | NOISE | 16 | 0 | 25 | 40 | 5.8 | 21.0 | none | none | lxc | incus | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-101395 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2025-58403 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 42.6 | none | cgm | cgm clininet | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101726 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 34.2 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-96903 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 3.0 | none | none | unknown | easy property listings | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101380 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101378 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101377 | NOISE | 16 | 0 | 25 | 40 | 2.7 | none | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113604 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | nationalsecurityagency | ghidra | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113681 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | academysoftwarefoundation | openimageio | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115373 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 10.7 | none | lxc | incus | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101738 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 11.7 | none | none | oracle corporation | oracle agile engineering data management | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113648 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 25.7 | none | none | apostrophecms, @apostrophecms | apostrophe · import-export | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-89319 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 10.7 | none | eclipse foundation | eclipse keypont – gose | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113601 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 23.2 | none | none | usememos | memos | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-111441 | NOISE | 16 | 0 | 25 | 40 | 8.1 | 33.3 | none | none | opengauss-server | opengauss-server | 2026-10-19 | no exploitation evidence in any monitored source | Upgrade to openGauss 7.0.0-LTS, which adds the lenUsed <= lenTotal check and corrects the memcpy_s() destination size (PR 9380). | ||
| CVE-2026-110725 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 15.9 | none | none | fast-uri | fast-uri | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-112956 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | apostrophecms, @apostrophecms | apostrophe · mport-export | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2025-13591 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 12.4 | none | none | wso2 | wso2 identity server · wso2 carbon abstract otp authenticator · email otp authenticator | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-91228 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91238 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91240 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | oracle webcenter sites | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111439 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 16.5 | none | none | opengauss-server | opengauss-server | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2025-60476 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 6.7 | none | none | n/a | n/a | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-89409 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | silicon labs | z-wave sdk | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101818 | NOISE | 16 | 0 | 25 | 40 | 7.7 | 15.4 | none | none | oracle corporation | oracle product hub | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101805 | NOISE | 16 | 0 | 25 | 40 | 3.3 | 18.1 | none | none | oracle corporation | oracle applications manager | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101799 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 13.5 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101794 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 32.3 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101793 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 3.4 | none | none | oracle corporation | oracle communications brm – elastic charging engine | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101790 | NOISE | 16 | 0 | 25 | 40 | 3.3 | 2.8 | none | none | oracle corporation | oracle communications brm – elastic charging engine | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101789 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 32.3 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101787 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 35.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91244 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91245 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle webcenter portal | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112199 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | yith | yith woocommerce wishlist | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101785 | NOISE | 16 | 0 | 25 | 40 | 8.3 | 31.1 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101784 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 35.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101779 | NOISE | 16 | 0 | 25 | 40 | 2.7 | 19.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101776 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 22.6 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-110892 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 22.0 | none | none | brainstorm force | suredash | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-101764 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 3.5 | none | none | oracle corporation | oracle communications billing and revenue management | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91246 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | oracle webcenter portal | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101762 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 23.0 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101760 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 22.6 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101753 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 25.7 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101752 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 25.7 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101751 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 35.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101748 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 32.3 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101747 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 32.3 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101743 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 32.3 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-112783 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 9.8 | none | none | opencats | opencats | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101740 | NOISE | 16 | 0 | 25 | 40 | 3.6 | 1.3 | none | none | oracle corporation | oracle agile engineering data management | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101737 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 27.5 | none | none | oracle corporation | oracle java se | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101734 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 21.0 | none | none | oracle corporation | oracle agile engineering data management | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101733 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 34.2 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101725 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 34.2 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101724 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 37.2 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101717 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 1.5 | none | none | oracle corporation | oracle agile plm | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101715 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 19.7 | none | none | oracle corporation | oracle agile plm | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101713 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 12.6 | none | none | oracle corporation | oracle agile plm | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101701 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 5.2 | none | none | oracle corporation | oracle concurrent processing | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2014-125131 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 10.8 | none | none | dedecms | dedecms | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2024-4412 | NOISE | 16 | 0 | 25 | 40 | 2.7 | 19.3 | none | none | wso2 | wso2 enterprise integrator · wso2 api manager · wso2 open banking iam +5 more | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-115502 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | none | knime | knime business hub | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91247 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | oracle webcenter portal | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114570 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 7.2 | none | none | wordpress foundation | wordpress | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-101750 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 35.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101749 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 35.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2016-20103 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 31.8 | none | cherry team | cherry plugin | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101366 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91260 | NOISE | 16 | 0 | 25 | 40 | 7.2 | none | oracle corporation | iprocurement | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101426 | NOISE | 16 | 0 | 25 | 40 | 6.9 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91282 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91283 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91284 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101502 | NOISE | 16 | 0 | 25 | 40 | 5.0 | none | oracle corporation | oracle trusted answer search | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114115 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 12.0 | none | none | vyperlang | vyper | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-91297 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112395 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 17.1 | none | python-pillow | pillow | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91298 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112898 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 20.4 | none | python-pillow | pillow | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91300 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111059 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 19.7 | none | none | mljar | mercury | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-112769 | NOISE | 16 | 0 | 25 | 40 | 2.3 | 17.3 | none | none | parse-community | parse-server | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-114138 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 36.4 | none | encode | django-rest-framework | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111938 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | frappe | crm | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111935 | NOISE | 16 | 0 | 25 | 40 | 2.6 | none | none | codexu | notegen | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112287 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | krayin | laravel-crm | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91301 | NOISE | 16 | 0 | 25 | 40 | 3.6 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111750 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | aio-libs | aiohttp | 2026-10-19 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86589 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache answer | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-108837 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache kylin | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-108766 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache kylin | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-85243 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114118 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 9.5 | none | vyperlang | vyper | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2021-48019 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 15.2 | none | vyperlang | vyper | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91302 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114114 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 7.5 | none | vyperlang | vyper | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114116 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 7.5 | none | vyperlang | vyper | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112249 | NOISE | 16 | 0 | 25 | 40 | 2.4 | 32.9 | none | none | grandnode | grandnode2 | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-101538 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle order management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112105 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | glitterware | passy | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113729 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 39.3 | none | moov-io | signedxml | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113776 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 15.1 | none | pypa | virtualenv | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112222 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | surfer | surfer | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114641 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 16.3 | none | traefik | traefik | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79613 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache answer | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-92823 | NOISE | 16 | 0 | 25 | 40 | 6.2 | 1.6 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 8 · red hat enterprise linux 9 +2 more | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-114439 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 44.5 | none | oretnom23 | php-travel-agency-system | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91435 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 33.3 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91309 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91312 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113873 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 44.0 | none | smilecdr | hapi fhir | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112914 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | tox-dev | filelock | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91057 | NOISE | 16 | 0 | 25 | 40 | 4.6 | none | none | eclipse foundation | eclipse threadx – guix | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96582 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | none | eclipse foundation | eclipse threadx – usbx | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96402 | NOISE | 16 | 0 | 25 | 40 | 5.2 | none | none | eclipse foundation | eclipse threadx – usbx | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91316 | NOISE | 16 | 0 | 25 | 40 | 7.2 | none | oracle corporation | iprocurement | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91317 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | oracle jdeveloper | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91318 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle jdeveloper | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91320 | NOISE | 16 | 0 | 25 | 40 | 5.7 | none | oracle corporation | oracle jdeveloper | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112787 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | opencats | opencats | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113495 | NOISE | 16 | 0 | 25 | 40 | 5.0 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 9 | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-55422 | NOISE | 16 | 0 | 25 | 40 | 4.6 | 5.3 | none | conda-forge | conda-forge.github.io | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91322 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | oracle corporation | oracle jdeveloper | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91324 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101568 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91397 | NOISE | 16 | 0 | 25 | 40 | 3.6 | 0.6 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91294 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91398 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 13.8 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91319 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | oracle jdeveloper | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91400 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 17.2 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113707 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | a2aproject | a2a-rs | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113737 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | r6410418 | jackrong-llm-finetuning-guide | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114048 | NOISE | 16 | 0 | 25 | 40 | 3.5 | 2.1 | none | wwbn | avideo | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91485 | NOISE | 16 | 0 | 25 | 40 | 3.8 | 1.1 | none | none | oracle corporation | peoplesoft enterprise fin cash management | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91486 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 0.6 | none | none | oracle corporation | peoplesoft enterprise fin general ledger brazil | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91487 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 6.1 | none | none | oracle corporation | oracle java se | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91501 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 2.8 | none | none | oracle corporation | oracle identity manager | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91519 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91523 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91524 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91526 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | none | oracle corporation | oracle bi publisher | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91528 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | oracle corporation | oracle bi publisher | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91576 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91582 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91588 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113491 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 16.1 | none | none | unknown | geodirectory | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-113489 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 9.5 | none | none | unknown | geodirectory | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-112863 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 3.8 | none | none | hogash | kallyas | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-107907 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 13.3 | none | none | unknown | mas videos | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-91482 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 25.4 | none | none | oracle corporation | peoplesoft enterprise scm strategic sourcing | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91598 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112097 | NOISE | 16 | 0 | 25 | 40 | 3.5 | 9.1 | none | none | sourcecodester | inventory system | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-91443 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 19.1 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91429 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 12.0 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113705 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | a2aproject | a2a-rs | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91422 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 15.8 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-109681 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 9.5 | none | rapid7 | metasploit framework | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91421 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 30.3 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91420 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 13.4 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-109682 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 5.5 | none | rapid7 | metasploit framework | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91409 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 31.6 | none | none | oracle corporation | oracle java se | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-111748 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | none | aio-libs | aiohttp | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113706 | NOISE | 16 | 0 | 25 | 40 | 3.5 | none | a2aproject | a2a-rs | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-95710 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 13.3 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-91411 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 18.6 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2020-37286 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 19.8 | none | vyperlang | vyper | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2020-37287 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 15.7 | none | vyperlang | vyper | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-85248 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2020-37288 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 19.8 | none | none | vyperlang | vyper | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2020-37289 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 17.0 | none | vyperlang | vyper | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2021-48020 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 19.8 | none | vyperlang | vyper | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113738 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | r6410418 | jackrong-llm-finetuning-guide | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114038 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 1.5 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +3 more | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-114044 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 15.4 | none | freerdp | freerdp | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114086 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112071 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 33.4 | none | none | typo3 | extension "typo3 shop by coding.ms" | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-114088 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112069 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 44.7 | none | none | typo3 | extension "fal protect" | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-112064 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 32.4 | none | none | typo3 | extension "sgalinski cookie consent" | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-112065 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 27.3 | none | none | typo3 | extension "sgalinski cookie consent" | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113442 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 41.4 | none | none | typo3 | extension "typo3 fluid-form by coding.ms" | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-111844 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 12.3 | none | none | brizy | brizy | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113383 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | optimal idm | optimalcloud | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114093 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112861 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | none | xnau webdesign | participants database | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-104947 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 11.4 | none | enterprisedb | warehousepg | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114695 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 10.3 | none | none | infomaniak network | vod infomaniak | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-113786 | NOISE | 16 | 0 | 25 | 40 | 2.3 | 30.3 | none | py-pdf | pypdf | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-102483 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 47.0 | none | ntpsec | ntpsec | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-102484 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 17.4 | none | ntpsec | ntpsec | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-102485 | NOISE | 16 | 0 | 25 | 40 | 5.2 | 14.0 | none | ntpsec | ntpsec | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113789 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 23.4 | none | py-pdf | pypdf | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113790 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 23.4 | none | py-pdf | pypdf | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113791 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 23.4 | none | py-pdf | pypdf | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113792 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 40.1 | none | none | py-pdf | pypdf | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-113793 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 39.3 | none | py-pdf | pypdf | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113794 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 39.3 | none | py-pdf | pypdf | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114462 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 22.1 | none | velneo | vserver | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114471 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 0.7 | none | progressive robot ltd | hmailserver | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114472 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 10.4 | none | progressive robot ltd | hmailserver | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114473 | NOISE | 16 | 0 | 25 | 40 | 5.0 | 14.7 | none | progressive robot ltd | hmailserver | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114702 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 2.4 | none | none | nicdark | nd shortcodes for visual composer | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-112313 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | acf extended | acf extended | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114703 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 2.4 | none | none | hupe13 | extensions for leaflet map | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114175 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 7.6 | none | none | digitalme | eroom | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114476 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 18.7 | none | progressive robot ltd | hmailserver | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114182 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 5.0 | none | none | ideabox creations | powerpack addons for elementor | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114184 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 2.4 | none | none | wpvibes | elementor addon elements | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114176 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 10.7 | none | none | digitalme | eroom | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-111851 | NOISE | 16 | 0 | 25 | 40 | 7.6 | 9.4 | none | none | wproyal | royal elementor addons | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-113798 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 10.3 | none | electron | electron | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113799 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 31.2 | none | abdolence | slack-morphism-rust | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114121 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 7.1 | none | electron | electron | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101565 | NOISE | 16 | 0 | 25 | 40 | 6.2 | none | oracle corporation | oracle agile plm | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101564 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | oracle agile plm | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101560 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | oracle corporation | oracle commerce platform | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101559 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle purchasing | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101558 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | oracle purchasing | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101553 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle payroll | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101548 | NOISE | 16 | 0 | 25 | 40 | 7.0 | none | oracle corporation | oracle application testing suite | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101547 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | oracle demand planning | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112294 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | sunkaifei | flycms | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112295 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | sunkaifei | flycms | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101524 | NOISE | 16 | 0 | 25 | 40 | 5.6 | none | oracle corporation | oracle enterprise manager base platform | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101522 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | oracle corporation | oracle timesten in-memory database | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101447 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | oracle corporation | siebel crm development | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101727 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 37.2 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101729 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 35.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101730 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 37.2 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101769 | NOISE | 16 | 0 | 25 | 40 | 7.0 | 18.8 | none | none | oracle corporation | mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101773 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 13.5 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101774 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 22.2 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-114178 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 10.3 | none | none | bold grid | w3 total cache | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-113674 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 10.5 | none | none | unknown | geodirectory | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-101775 | NOISE | 16 | 0 | 25 | 40 | 7.4 | 27.5 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91428 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 9.9 | none | none | oracle corporation | siebel crm end user | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-110902 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | liquid web / stellarwp | event tickets | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101801 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 35.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101804 | NOISE | 16 | 0 | 25 | 40 | 2.5 | 1.5 | none | none | oracle corporation | mysql connectors | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101807 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 11.8 | none | none | oracle corporation | oracle communications billing and revenue management | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-112259 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 1.1 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-55644 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 22.0 | none | none | element-hq | element-x-ios | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-95719 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 26.8 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114119 | NOISE | 16 | 11 | 13 | 30 | 9.8 | 36.0 | none | best practice software | bp premier | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to Bp Premier 1.14.1.1128 or later (Oxford SP1), which removes the hardcoded SQL Server administrative credential. | |||
| CVE-2026-105814 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 12.6 | none | none | tp-link systems inc. | tapo c210 v3.6 | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-113384 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 15.4 | none | none | optimal idm | optimalcloud | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113386 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 61.6 | none | none | roundcube | webmail | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-89315 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 16.6 | none | eclipse foundation | eclipse keypont – gose | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-11959 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 13.0 | none | none | facturascripts | facturascripts | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101373 | NOISE | 16 | 0 | 25 | 40 | 2.4 | none | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101374 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112838 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 8.6 | none | none | e4jvikwp | vikrentcar | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-101389 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101618 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101623 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2025-30046 | NOISE | 16 | 0 | 13 | 49 | 9.0 | 18.0 | none | cgm | cgm clininet | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101625 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | oracle corporation | mysql connectors | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101626 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | oracle corporation | mysql connectors | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101628 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111738 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 20.3 | none | none | unknown | speed optimizer | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-112240 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 34.8 | none | none | typo3 | extension "typo3 fluid-form by coding.ms" | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101629 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101630 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | oracle corporation | oracle advanced outbound telephony | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-92824 | NOISE | 16 | 0 | 25 | 40 | 6.2 | 1.6 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 8 · red hat enterprise linux 9 +2 more | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-101400 | NOISE | 16 | 0 | 25 | 40 | 2.9 | 4.4 | none | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-108764 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache kylin | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-108771 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache kylin | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-108776 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache kylin | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-108823 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache kylin | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-111843 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | cozythemes | rootblox | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-71563 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 4.9 | none | none | apache software foundation | apache answer | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-68482 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache answer | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-91407 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 35.8 | none | none | oracle corporation | oracle identity manager | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-76994 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache answer | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-79620 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache answer | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-79624 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache answer | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-79633 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache answer | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-115400 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | crawlseo | crawlseo | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101666 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | oracle corporation | oracle trade management | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101668 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | oracle corporation | oracle customer care | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101670 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | oracle email center | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101671 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | oracle corporation | oracle email center | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115398 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 5.7 | none | none | nationalsecurityagency | ghidra | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114700 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 2.4 | none | none | gloriafood | restaurant menu – food ordering system – table reservation | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114701 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 2.4 | none | none | xootix | waitlist woocommerce ( back in stock notifier ) | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-101673 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | oracle us federal human resources | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101677 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | oracle corporation | mysql connectors | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91378 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | oracle corporation | siebel crm integration | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91383 | NOISE | 16 | 0 | 25 | 40 | 6.6 | none | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91387 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | oracle corporation | siebel crm end user | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76787 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 19.8 | none | none | zephyrproject | zephyr | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-91388 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | none | oracle corporation | siebel crm end user | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111830 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 3.5 | none | none | wp mailster | wp mailster | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-91391 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | oracle corporation | siebel crm end user | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91518 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | oracle corporation | oracle bi publisher | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91553 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | none | oracle corporation | peoplesoft enterprise fin product configurator brazil | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112379 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 3.5 | none | none | codepeople | contact form email | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-91462 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 18.6 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91463 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 13.4 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91464 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 20.5 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-88041 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache tomcat | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-112833 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | castos | seriously simple podcasting | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112935 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | tox-dev | filelock | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112945 | NOISE | 16 | 0 | 25 | 40 | 2.1 | none | vitejs | vite-plus | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112950 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | vitest-dev, @vitest | vitest · mocker | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113683 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 29.3 | none | none | jcrodriguez-dis | moodle-mod_vpl | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-106932 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | unknown | moloni | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113665 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | apostrophecms | apostrophe | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105996 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | none | unknown | booking package | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91577 | NOISE | 16 | 0 | 25 | 40 | 6.4 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114120 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 20.0 | none | none | wpdeveloper | schedulepress | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-78116 | NOISE | 16 | 0 | 25 | 40 | 5.2 | 10.6 | none | none | zephyrproject | zephyr | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-113714 | NOISE | 16 | 0 | 25 | 40 | 2.3 | none | pypa | virtualenv | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-97406 | NOISE | 16 | 0 | 25 | 40 | none | xerj | console api | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-113718 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 3.2 | none | pypa | virtualenv | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113719 | NOISE | 16 | 0 | 25 | 40 | 4.5 | 1.6 | none | pypa | virtualenv | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113721 | NOISE | 16 | 0 | 25 | 40 | 4.5 | 1.6 | none | pypa | virtualenv | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2015-20123 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 34.4 | none | aspose | aspose doc exporter | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2015-20125 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 34.4 | none | aspose | aspose pdf exporter | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-109933 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 23.2 | none | none | unknown | otter blocks | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-114407 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 16.2 | none | none | e107inc | e107 | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-114741 | NOISE | 16 | 0 | 25 | 40 | 3.8 | 2.8 | none | none | unknown | wpvr | 2026-10-25 | no exploitation evidence in any monitored source | |||
| CVE-2026-101103 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 1.9 | none | hms networks | peak-system device driver setup · pcan windows can device drivers | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-103672 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 2.1 | none | hms networks | peak-system device driver setup · pcan windows can device drivers | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101360 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101412 | NOISE | 16 | 0 | 25 | 40 | 5.8 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101413 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101414 | NOISE | 16 | 0 | 25 | 40 | 2.9 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101415 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101417 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101418 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101419 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101423 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101424 | NOISE | 16 | 0 | 25 | 40 | 5.8 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101425 | NOISE | 16 | 0 | 25 | 40 | 2.5 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101432 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101449 | NOISE | 16 | 0 | 25 | 40 | 2.4 | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101450 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101453 | NOISE | 16 | 0 | 25 | 40 | 6.7 | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101455 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | oracle corporation | siebel crm development | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101470 | NOISE | 16 | 0 | 25 | 40 | 6.0 | none | oracle corporation | oracle product lifecycle analytics | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101471 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | oracle product lifecycle analytics | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101472 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | oracle corporation | oracle product lifecycle analytics | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101474 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101476 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101480 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | oracle secure backup | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101483 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle secure backup | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101485 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle autonomous health framework | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101486 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101487 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101488 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101489 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101490 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101491 | NOISE | 16 | 0 | 25 | 40 | 5.0 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101492 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | oracle corporation | siebel crm integration | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101493 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101497 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | oracle corporation | oracle identity manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91628 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | oracle corporation | oracle communications billing and revenue management | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91616 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | oracle corporation | oracle middleware common libraries and tools | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101507 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle trusted answer search | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101510 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | oracle corporation | oracle net services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101511 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | oracle corporation | oracle enterprise manager base platform | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101512 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle database server | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101513 | NOISE | 16 | 0 | 25 | 40 | 3.8 | none | oracle corporation | mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101515 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | oracle weblogic server | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101516 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101517 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | oracle corporation | oracle utilities network management system | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101539 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle payroll | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101544 | NOISE | 16 | 0 | 25 | 40 | 7.0 | none | oracle corporation | oracle payroll | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101545 | NOISE | 16 | 0 | 25 | 40 | 7.0 | none | oracle corporation | oracle inventory management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101611 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101612 | NOISE | 16 | 0 | 25 | 40 | 4.0 | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101613 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101614 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101615 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101616 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101617 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101620 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101819 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 28.0 | none | none | oracle corporation | oracle general ledger | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101832 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle order management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101836 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | isupplier portal | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101840 | NOISE | 16 | 0 | 25 | 40 | 7.2 | none | oracle corporation | oracle contract lifecycle management for public sector | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101843 | NOISE | 16 | 0 | 25 | 40 | 4.5 | none | oracle corporation | production scheduling | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101844 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | oracle corporation | oracle concurrent processing | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101845 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | oracle corporation | oracle purchasing | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101846 | NOISE | 16 | 0 | 25 | 40 | 3.5 | none | oracle corporation | oracle purchasing | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101850 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | installed base | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101851 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | oracle corporation | installed base | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101855 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle product hub | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101856 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle order management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101857 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle order management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114391 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 21.4 | none | none | easysoft | zentaopms | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-91612 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | none | oracle corporation | oracle communications unified inventory management | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101731 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 37.2 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-93003 | NOISE | 16 | 0 | 25 | 40 | 6.9 | none | none | eclipse foundation | eclipse threadx – netx duo | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101735 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 21.1 | none | none | oracle corporation | primavera unifier | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-115371 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 12.3 | none | lxc | incus | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112911 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | tox-dev | filelock | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115370 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 30.1 | none | none | lxc | incus | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-91208 | NOISE | 16 | 0 | 25 | 40 | 5.1 | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91209 | NOISE | 16 | 0 | 25 | 40 | 4.2 | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91210 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91256 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91257 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | isupport | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91261 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91262 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101384 | NOISE | 16 | 0 | 25 | 40 | 5.0 | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91264 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | peoplesoft enterprise scm manufacturing | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101430 | NOISE | 16 | 0 | 25 | 40 | 6.2 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91285 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | jd edwards enterpriseone orchestrator | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101433 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101570 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91329 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91330 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91331 | NOISE | 16 | 0 | 25 | 40 | 3.8 | none | oracle corporation | peoplesoft enterprise cc common application objects | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101571 | NOISE | 16 | 0 | 25 | 40 | 5.6 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91333 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | oracle java se | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101576 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91334 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91335 | NOISE | 16 | 0 | 25 | 40 | 2.6 | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101607 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91351 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91379 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91380 | NOISE | 16 | 0 | 25 | 40 | 4.0 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-60819 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91381 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | oracle corporation | oracle java se · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91382 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91384 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91385 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | oracle corporation | oracle java se · oracle javafx · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-83392 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | oracle corporation | oracle applications manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91389 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | oracle corporation | siebel crm end user | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91390 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | oracle corporation | siebel crm end user | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87383 | NOISE | 16 | 0 | 25 | 40 | 6.7 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91399 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 9.0 | none | none | oracle corporation | primavera p6 enterprise project portfolio management | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91562 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | none | oracle corporation | peoplesoft enterprise fin inventory brazil | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91614 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | none | oracle corporation | oracle communications unified inventory management | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87411 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87410 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87409 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111943 | NOISE | 16 | 0 | 25 | 40 | 3.4 | none | go standard library | crypto/x509 | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113743 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | tenstorrent | tt-metal | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110982 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | none | unknown | ai engine | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111948 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | unknown | user profile builder | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96901 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | unknown | cart abandonment recovery for woocommerce | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110899 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | kevin stover | ninja forms | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-104642 | NOISE | 16 | 0 | 25 | 40 | 2.7 | none | none | unknown | simple shopping cart | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-35501 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 1.2 | none | nlnet labs | unbound | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91536 | NOISE | 16 | 0 | 25 | 40 | 5.0 | none | none | oracle corporation | oracle soa suite | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91555 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | oracle corporation | oracle bi publisher | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91559 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | none | oracle corporation | peoplesoft enterprise fin manufacturing brazil | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91574 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | oracle bi publisher | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114054 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 18.8 | none | vllm-project | vllm | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114056 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | arcadedata | arcadedb | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115972 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 19.8 | none | faveosuite | faveo helpdesk | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114058 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | arcadedata | arcadedb | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114064 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 18.2 | none | grokability | snipe-it | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112106 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | tufayellus | tiktok-video-downloader-php | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114079 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115802 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 21.1 | none | internscience | internagent | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91480 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 25.5 | none | none | oracle corporation | peoplesoft enterprise scm strategic sourcing | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-114622 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 41.7 | none | baserproject | basercms | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96293 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 0.0 | none | none | watchguard | watchguard agent | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-113662 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | apostrophecms, @apostrophecms | apostrophe · import-export | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105960 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 1.4 | none | hms networks | peak-system device driver setup · pcan windows can device drivers | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101403 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 16.6 | none | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-115322 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | bytebase | bytebase | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-51954 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-22 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-101761 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 18.7 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-112771 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 14.3 | none | none | craftcms | cms | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-101766 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 25.8 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-112786 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | opencats | opencats | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-95620 | NOISE | 16 | 0 | 25 | 40 | 2.1 | 13.6 | none | qt | qt | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112260 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101798 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 35.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91269 | NOISE | 16 | 7 | 1 | 50 | 8.1 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112286 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | krayin | laravel-crm | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112285 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | thelia | thelia | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-109434 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | fenrir | sleipnir mobile for android | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112329 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | automattic | sensei lms | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101802 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 32.3 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-115994 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 12.5 | none | cervantessec | cervantes | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101803 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 35.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2024-2323 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 5.8 | none | none | wso2 | wso2 enterprise integrator · wso2 api manager · wso2 open banking am +3 more | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-115387 | NOISE | 16 | 0 | 25 | 40 | 6.2 | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115388 | NOISE | 16 | 0 | 25 | 40 | 6.2 | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115389 | NOISE | 16 | 0 | 25 | 40 | 2.3 | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115454 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | knime | knime business hub | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116053 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | dbcli | mycli | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116139 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | wwbn | avideo | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116143 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116144 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116146 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116147 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116150 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116151 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116156 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116178 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | vllm-project | vllm | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116195 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | rclone | rclone | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101718 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 18.3 | none | none | oracle corporation | oracle agile plm | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-115937 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 5.8 | none | craftcms | commerce-mollie | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-83373 | NOISE | 16 | 0 | 25 | 40 | 3.0 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83376 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83377 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle hrms (us) | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83378 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | oracle corporation | oracle java se | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83380 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83381 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | oracle corporation | oracle java se | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87382 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | jd edwards enterpriseone operational sourcing | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-85296 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-83387 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83390 | NOISE | 16 | 0 | 25 | 40 | 4.2 | none | oracle corporation | oracle applications manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83401 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | oracle identity manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87307 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87308 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-39902 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 34.2 | none | cacti | cacti | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87311 | NOISE | 16 | 0 | 25 | 40 | 5.6 | none | oracle corporation | oracle vm virtualbox | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87374 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115326 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | webkul | qloapps | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-96405 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 14.0 | none | nlnet labs | unbound | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114402 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 22.1 | none | polonel | trudesk | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87373 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114043 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 19.2 | none | freerdp | freerdp | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114394 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 19.3 | none | none | polonel | trudesk | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-114051 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 30.2 | none | vllm-project | vllm | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114393 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 12.2 | none | polonel | trudesk | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96641 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 19.4 | none | python-pillow | pillow | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111410 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | e2pdf.com | e2pdf | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114144 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 26.1 | none | binarymuse | toml-node | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82942 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-54426 | NOISE | 16 | 0 | 25 | 40 | 4.6 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87865 | NOISE | 16 | 0 | 25 | 40 | 18.9 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-94266 | NOISE | 16 | 0 | 25 | 40 | 18.9 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-92389 | NOISE | 16 | 0 | 25 | 40 | 20.5 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-104948 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 11.4 | none | enterprisedb | warehousepg | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114106 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 36.5 | none | hkuds | vibe-trading | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-97206 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 17.1 | none | nlnet labs | unbound | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114101 | NOISE | 16 | 0 | 25 | 40 | 4.0 | 9.1 | none | corazawaf | coraza | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114103 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | cthackers | adm-zip | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114105 | NOISE | 16 | 0 | 25 | 40 | 6.2 | none | none | cthackers | adm-zip | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114694 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 16.6 | none | none | pixelite | events manager | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-114478 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 16.9 | none | progressive robot ltd | hmailserver | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114693 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 7.8 | none | none | plugins360 labs | all-in-one video gallery | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-113797 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 40.9 | none | electron | electron | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111414 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | crocoblock | jetelements for elementor | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111828 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | mamunur rashid | classified listing | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111829 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | wp mailster | wp mailster | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111836 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | wp manageninja llc | fluentcommunity | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107079 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-22 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-114267 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 22.3 | none | sourcecodester | food order management system | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114406 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 23.6 | none | red hat | red hat enterprise linux 10.0 extended update support · red hat enterprise linux 7 extended lifecycle support · red hat enterprise linux 8.4 advanced mission critical update support +15 more | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96636 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 19.4 | none | python-pillow | pillow | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96638 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 19.4 | none | python-pillow | pillow | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108013 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 4.8 | none | hcl software | bigfix platform | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96642 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 25.3 | none | python-pillow | pillow | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96644 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 25.3 | none | python-pillow | pillow | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96778 | NOISE | 16 | 0 | 25 | 40 | 7.7 | 33.2 | none | python-pillow | pillow | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-97353 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 12.5 | none | none | unknown | news kit addons for elementor | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-114501 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 31.2 | none | python-pillow | pillow | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114440 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 26.6 | none | oretnom23 | php-travel-agency-system | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114719 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 15.0 | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114722 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 15.8 | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114723 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 25.2 | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114460 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 18.8 | none | pbuchbinder | mod_qos | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112207 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 11.5 | none | none | unknown | download monitor | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2023-54413 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | onthegosystems | wpml multilingual cms | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115248 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | subhajitkhan | online-clinic-management-system | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115249 | NOISE | 16 | 0 | 25 | 40 | 4.6 | none | subhajitkhan | online-clinic-management-system | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-89410 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 7.8 | none | none | silicon labs | z-wave sdk | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114510 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | stevereiner | flexible-graphrag | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114606 | NOISE | 16 | 0 | 25 | 40 | 5.6 | none | jgraph | drawio-desktop | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114608 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | pylint-dev | pylint | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114609 | NOISE | 16 | 0 | 25 | 40 | 5.8 | 16.5 | none | py-pdf | fpdf2 | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115351 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | lepture | mistune | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115354 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | lepture | mistune | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115358 | NOISE | 16 | 0 | 25 | 40 | 2.0 | 9.1 | none | openbao | openbao | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115359 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 8.3 | none | openbao | openbao | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115361 | NOISE | 16 | 0 | 25 | 40 | 4.1 | 10.4 | none | openbao | openbao | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115362 | NOISE | 16 | 0 | 25 | 40 | 2.2 | 9.4 | none | openbao | openbao | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115397 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 1.9 | none | nationalsecurityagency | ghidra | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115517 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 37.0 | none | knime | knime business hub | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115519 | NOISE | 16 | 0 | 25 | 40 | 2.1 | 8.2 | none | knime | knime business hub | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113787 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 10.1 | none | githubnewbie0 | odf-kit | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-8168 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | qt | qt | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114614 | NOISE | 16 | 0 | 25 | 40 | 2.6 | 7.2 | none | authlib | authlib | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111594 | NOISE | 16 | 0 | 13 | 50 | 8.1 | 8.5 | none | intersystems | iris for health | 2026-10-22 | no exploitation evidence in any monitored source | Configure the IRIS superserver to require SSL/TLS rather than the default Disabled setting, per InterSystems’ security checklist. | |||
| CVE-2026-54631 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 1.2 | none | part-db | part-db-server | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-55600 | NOISE | 16 | 0 | 25 | 40 | 5.7 | 22.2 | none | part-db | part-db-server | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2025-30043 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 10.7 | none | cgm | cgm clininet | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2025-30045 | NOISE | 16 | 0 | 13 | 49 | 8.6 | 9.6 | none | cgm | cgm clininet | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115929 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 8.3 | none | mongodb, inc. | compass | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115807 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 11.2 | none | cozmoslabs | user profile builder – beautiful user registration forms, user profiles & user role editor | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112280 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | nkoriyama | aribb24 | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2025-30053 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 28.6 | none | cgm | cgm clininet | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2025-30054 | NOISE | 16 | 0 | 13 | 50 | 9.3 | 0.8 | none | cgm | cgm clininet | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-89317 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 3.9 | none | eclipse foundation | eclipse keypont – gose | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-89318 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 5.9 | none | eclipse foundation | eclipse keypont – gose | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-89320 | NOISE | 16 | 0 | 13 | 50 | 8.8 | 6.8 | none | eclipse foundation | eclipse keypont – gose | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115722 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 2.5 | none | diegonehab | rply | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115725 | NOISE | 16 | 0 | 25 | 40 | 4.2 | 15.0 | none | chatwoot | chatwoot | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115726 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 5.6 | none | aider-ai | aider | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115730 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 12.0 | none | i18next | i18next-http-backend | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115786 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 31.1 | none | zimbra | zimbra collaboration suite | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57207 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 18.1 | none | netboxlabs | netbox-mcp-server | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113732 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 10.8 | none | pypa | virtualenv | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-55442 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 17.9 | none | intranda | goobi-viewer-core | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-55444 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 16.7 | none | intranda | goobi-viewer-core | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-75524 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 8.1 | none | open-reception | appointment-booking-software | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-83813 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 1.5 | none | twisted | twisted | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115477 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 28.8 | none | the-40-thieves | obsidian-tc | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87372 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87371 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115801 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 1.4 | none | kakao | khaiii | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-60500 | NOISE | 16 | 0 | 25 | 40 | 5.8 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116008 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 9.2 | none | bottelet | daybydaycrm | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116010 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 9.2 | none | francoisjacquet | rosariosis | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116012 | NOISE | 16 | 0 | 25 | 40 | 3.6 | 11.1 | none | nationalsecurityagency | ghidra | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116013 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 21.1 | none | openresty | lua-resty-dns | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87317 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87318 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87319 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115970 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 23.0 | none | travisun | opptrix | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116044 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 10.5 | none | prasathmani | tinyfilemanager | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116045 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 24.6 | none | 1999azzar | designer-mcp | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91412 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 27.3 | none | none | oracle corporation | siebel crm end user | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-116047 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 18.0 | none | privoce | vocechat | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116052 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | linkstackorg | linkstack | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116140 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116141 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116142 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116145 | NOISE | 16 | 0 | 25 | 40 | 3.9 | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87325 | NOISE | 16 | 0 | 25 | 40 | 6.4 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116181 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | vllm-project | vllm | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110379 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | ays pro | quiz maker | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87343 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87344 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114268 | NOISE | 16 | 1 | 13 | 50 | 9.9 | 42.7 | none | tenda | be3l pro | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116182 | NOISE | 16 | 0 | 25 | 40 | 5.0 | none | thorsten | phpmyfaq | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115975 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 11.8 | none | cervantessec | cervantes | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114392 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 27.4 | none | polonel | trudesk | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116188 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | rclone | rclone | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116190 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | rclone | rclone | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116192 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | rclone | rclone | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87370 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116193 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | rclone | rclone | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-55889 | NOISE | 16 | 0 | 25 | 40 | 8.3 | 27.7 | none | none | flatpak | xdg-desktop-portal | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade xdg-desktop-portal to version 1.22.1 or later. | ||
| CVE-2026-87352 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87367 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-60839 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115479 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 22.7 | none | baserproject | basercms | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116095 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | smg-project | smg | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-70869 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-106765 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 42.7 | none | n/a | n/a | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-73964 | NOISE | 16 | 0 | 25 | 40 | 2.7 | none | oracle corporation | oracle database server | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101728 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 34.2 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-83139 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle order management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-49442 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 14.5 | none | cacti | cacti | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-55465 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 17.8 | none | intranda | goobi-viewer-core | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-55463 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 3.0 | none | intranda | goobi-viewer-core | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115567 | NOISE | 16 | 0 | 25 | 40 | 5.8 | 1.3 | none | tokio-rs | tokio | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-83372 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87362 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle agile plm | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115892 | NOISE | 16 | 0 | 25 | 40 | 5.7 | 37.4 | none | bytecodealliance | wasmtime | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115887 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 34.8 | none | graphql-hive | graphql-scalars | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101408 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87333 | NOISE | 16 | 0 | 25 | 40 | 3.6 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115356 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 11.5 | none | none | openbao | openbao | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-111079 | NOISE | 16 | 0 | 25 | 40 | 7.4 | 22.7 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 9 | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2025-60491 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 16.3 | none | none | n/a | n/a | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-115366 | NOISE | 16 | 0 | 25 | 40 | 2.6 | 7.4 | none | none | openbao | openbao | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-112219 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 25.6 | none | none | unknown | download monitor | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-57113 | NOISE | 16 | 0 | 25 | 40 | 8.1 | 34.4 | none | none | mervinpraison | praisonai | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to PraisonAI 4.6.59 or later, which patches the template cache path traversal. | ||
| CVE-2026-101435 | NOISE | 16 | 0 | 25 | 40 | 6.6 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-57121 | NOISE | 16 | 0 | 25 | 40 | 8.1 | 25.8 | none | none | mervinpraison | praisonai | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade praisonai-platform to version 0.1.5 or later. | ||
| CVE-2026-112068 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 27.3 | none | none | typo3 | extension "analytics" | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101573 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101574 | NOISE | 16 | 0 | 25 | 40 | 6.9 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101575 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101577 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101578 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101579 | NOISE | 16 | 0 | 25 | 40 | 7.2 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101580 | NOISE | 16 | 0 | 25 | 40 | 5.8 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101582 | NOISE | 16 | 0 | 25 | 40 | 5.8 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101583 | NOISE | 16 | 0 | 25 | 40 | 7.0 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101584 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112085 | NOISE | 16 | 0 | 25 | 40 | 8.2 | 5.3 | none | none | webpack-dev-server | webpack-dev-server | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to webpack-dev-server 5.2.7 or later, or 6.1.0 or later; as a workaround, omit WebSocket forwarding from proxy entries that do not need it and scope the proxy to specific paths. | ||
| CVE-2026-103234 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 11.4 | none | none | unknown | wp ultimate review | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-111972 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 2.5 | none | none | unknown | photo engine (media organizer & lightroom) | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-88849 | NOISE | 16 | 0 | 25 | 40 | 2.7 | 2.5 | none | none | unknown | masterstudy lms wordpress plugin | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-112843 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 4.0 | none | none | wp chill | strong testimonials | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-101585 | NOISE | 16 | 0 | 25 | 40 | 7.2 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101586 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101588 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | helidon | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101589 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | oracle utilities network management system | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101591 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87334 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | oracle corporation | oracle jdeveloper | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112845 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 2.4 | none | none | jory hogeveen | off-canvas sidebars & menus (slidebars) | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114698 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 7.7 | none | none | mycred | mycred | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-101592 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114389 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 18.8 | none | none | chamilo | chamilo-lms | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-101595 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101597 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | oracle zfs storage appliance kit | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101600 | NOISE | 16 | 0 | 25 | 40 | 3.6 | none | oracle corporation | oracle timesten in-memory database | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-67249 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | apache software foundation | apache answer | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101601 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | oracle corporation | oracle goldengate | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107435 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | wp chill | strong testimonials | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101602 | NOISE | 16 | 7 | 1 | 50 | 8.0 | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109926 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | unknown | productive commerce | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101605 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | oracle utilities network management system | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109147 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | unknown | wp booking system | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101606 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle communications billing and revenue management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101608 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101609 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101610 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101678 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | oracle corporation | mysql connectors | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101709 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 12.6 | none | none | oracle corporation | oracle payroll | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101714 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 15.9 | none | none | oracle corporation | oracle agile plm | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-116055 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | sourcecodester | performance indicator system | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113355 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | none | chatwoot | chatwoot | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113350 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | marmelab | react-admin | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-109700 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | elightup | meta box – wordpress custom fields framework | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113353 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | thimpress | learnpress | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113607 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | jleyva | moodle-block_configurablereports | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93446 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache tomcat | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-101732 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 37.2 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-115374 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 7.9 | none | none | lxc | incus | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-97400 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | none | eclipse foundation | eclipse openj9 | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113731 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | djust-org | djust | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87389 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | jd edwards enterpriseone human resources management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87390 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87391 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | oracle corporation | webcenter content: imaging | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87393 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87396 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87399 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91248 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | oracle webcenter portal | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91249 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91274 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91275 | NOISE | 16 | 0 | 25 | 40 | 6.6 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91276 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | jd edwards enterpriseone orchestrator | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91277 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | jd edwards enterpriseone orchestrator | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91278 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91279 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91280 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91281 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91289 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91290 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101475 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | primavera unifier | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91291 | NOISE | 16 | 0 | 25 | 40 | 3.6 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91292 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | jd edwards enterpriseone localizations | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91293 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91336 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91338 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | oracle corporation | isupport | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91339 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | isupport | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91356 | NOISE | 16 | 0 | 25 | 40 | 4.2 | none | oracle corporation | peoplesoft enterprise hcm global payroll switzerland | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91357 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | oracle order management | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91392 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | oracle corporation | siebel crm end user | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91394 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 35.9 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-87331 | NOISE | 16 | 0 | 25 | 40 | 3.4 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87392 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | webcenter content: imaging | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87407 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | oracle applications framework | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91402 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 15.3 | none | none | oracle corporation | oracle java se · oracle javafx · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91404 | NOISE | 16 | 0 | 25 | 40 | 4.0 | 5.2 | none | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-114061 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 6.5 | none | sveltejs | kit | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91438 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 20.0 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-114099 | NOISE | 16 | 0 | 25 | 40 | 5.8 | 9.1 | none | corazawaf | coraza | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114104 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | cthackers | adm-zip | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91547 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | oracle corporation | oracle goldengate | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91617 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | oracle corporation | oracle middleware common libraries and tools | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114071 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114073 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114074 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-82819 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 38.7 | none | cerberus | cerberus ftp server | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105257 | NOISE | 16 | 0 | 25 | 40 | 2.7 | none | none | unknown | appointment booking plugin | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107128 | NOISE | 16 | 0 | 25 | 40 | 5.0 | none | none | unknown | uncanny toolkit for learndash | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114236 | NOISE | 16 | 0 | 25 | 40 | 3.3 | 1.0 | none | red hat | confidential compute attestation · dpu kit for nvidia · exploit intelligence +16 more | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-14556 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | unknown | happyforms | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-50106 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 8.6 | none | nlnet labs | unbound | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115998 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 9.5 | none | cervantessec | cervantes | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105923 | NOISE | 16 | 0 | 25 | 40 | 4.0 | 1.7 | none | qt | qt | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-58663 | NOISE | 16 | 0 | 25 | 40 | 19.0 | none | apache software foundation | apache iotdb | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-48830 | NOISE | 16 | 0 | 25 | 40 | 17.2 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-54425 | NOISE | 16 | 0 | 25 | 40 | 16.4 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-54427 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-56387 | NOISE | 16 | 0 | 25 | 40 | 18.7 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-58064 | NOISE | 16 | 0 | 25 | 40 | 9.6 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-59562 | NOISE | 16 | 0 | 25 | 40 | 19.7 | none | apache software foundation | apache iotdb | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-61916 | NOISE | 16 | 0 | 25 | 40 | 9.6 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-74758 | NOISE | 16 | 0 | 25 | 40 | 14.7 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-78048 | NOISE | 16 | 0 | 25 | 40 | 14.5 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91607 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91600 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | oracle corporation | oracle business intelligence enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91590 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | oracle corporation | oracle bi publisher | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-78066 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-78334 | NOISE | 16 | 0 | 25 | 40 | 16.9 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87422 | NOISE | 16 | 0 | 25 | 40 | 2.5 | none | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87421 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87418 | NOISE | 16 | 0 | 25 | 40 | 2.5 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87416 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87415 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87414 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87413 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87412 | NOISE | 16 | 0 | 25 | 40 | 2.7 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87401 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114194 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 7.8 | none | none | igor funa | ad inserter | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-90458 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 20.0 | none | openstack | ironic | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112265 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | langbot-app | langbot | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-54615 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 30.9 | none | none | part-db | part-db-server | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-115993 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 24.9 | none | cervantessec | cervantes | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114397 | NOISE | 16 | 0 | 25 | 40 | 7.4 | 35.2 | none | polonel | trudesk | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114398 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 7.4 | none | polonel | trudesk | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114697 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 10.3 | none | none | quarka | qa analytics | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-112184 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | none | misp | misp | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82231 | NOISE | 16 | 0 | 25 | 40 | 3.6 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84748 | NOISE | 16 | 0 | 25 | 40 | 7.0 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86147 | NOISE | 16 | 0 | 25 | 40 | 9.8 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86249 | NOISE | 16 | 0 | 25 | 40 | 24.3 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112248 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | none | grandnode | grandnode2 | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115638 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 11.4 | none | none | openstack | ironic | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-85312 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112869 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 9.9 | none | none | noah hearle | we’re open! | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-110034 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 6.4 | none | none | unknown | salon booking system | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2024-58394 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | retool | retool | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114374 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 13.9 | none | leomoon-studios | wiki-go | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114376 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 21.0 | none | leomoon-studios | wiki-go | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-85518 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 25.7 | none | red hat | red hat hardened images · red hat enterprise linux 10 · red hat enterprise linux 6 +3 more | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114574 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 22.5 | none | masscodeio | masscode | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114714 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 29.3 | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114577 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 26.6 | none | oretnom23 | php-travel-agency-system | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114633 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 23.0 | none | wwbn | avideo | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114715 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 26.3 | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-97352 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 9.5 | none | none | unknown | news kit addons for elementor | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-114718 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 14.3 | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114724 | NOISE | 16 | 0 | 25 | 40 | 7.4 | 17.0 | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114726 | NOISE | 16 | 0 | 25 | 40 | 5.8 | 24.9 | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115207 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +3 more | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115319 | NOISE | 16 | 0 | 25 | 40 | 2.5 | none | junegunn | fzf | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115321 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 20.7 | none | none | bytebase | bytebase | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-115365 | NOISE | 16 | 0 | 25 | 40 | 6.6 | 22.9 | none | openbao | openbao | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115369 | NOISE | 16 | 0 | 25 | 40 | 2.2 | 2.9 | none | openbao | openbao | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111937 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | frappe | crm | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115503 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 1.9 | none | nationalsecurityagency | ghidra | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115504 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 2.8 | none | heasarc | cfitsio | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115505 | NOISE | 16 | 0 | 25 | 40 | 7.6 | 10.7 | none | sahlberg | libsmb2 | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115507 | NOISE | 16 | 0 | 25 | 40 | 3.5 | 9.3 | none | go-vikunja | vikunja | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115508 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 23.0 | none | unclecode | crawl4ai | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115509 | NOISE | 16 | 0 | 25 | 40 | 4.2 | 6.2 | none | jitsucom | jitsu | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114583 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 11.7 | none | python software foundation | cpython | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114616 | NOISE | 16 | 0 | 25 | 40 | 7.4 | 11.4 | none | authlib | authlib | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114618 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 13.1 | none | authlib | authlib | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114619 | NOISE | 16 | 0 | 25 | 40 | 4.6 | 4.8 | none | authlib | authlib | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114620 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 21.4 | none | authlib | authlib | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115424 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 5.5 | none | red hat | red hat openshift container platform 4 | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115536 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 19.5 | none | gedelumbung | hospitalmanagement | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-55981 | NOISE | 16 | 0 | 13 | 49 | 9.6 | 13.8 | none | creative labs | creative sound blaster katana v2, v2x, se | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-4950 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 23.5 | none | vertigis ltd. | webordersystem (kundenmanager) | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-4951 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 29.8 | none | vertigis ltd. | webordersystem (kundenmanager) | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-4952 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 20.7 | none | vertigis ltd. | webordersystem (auftragsmanager) | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87335 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | applications dba | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115750 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 12.5 | none | agentfront | mcp-from-openapi | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115751 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 16.2 | none | agentfront | mcp-from-openapi | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-55190 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 18.0 | none | eventschedule | eventschedule | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114357 | NOISE | 16 | 0 | 13 | 50 | 9.3 | 23.7 | none | dji | crystalsky zs600c | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114624 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 49.0 | none | baserproject | basercms | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115457 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 22.0 | none | baserproject | basercms | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-106763 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 42.7 | none | n/a | n/a | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-106764 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 42.7 | none | n/a | n/a | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115478 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 25.1 | none | the-40-thieves | obsidian-tc | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-46347 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 16.7 | none | intranda | goobi-viewer-core | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-46531 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 10.3 | none | cacti | cacti | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115774 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 37.0 | none | twisted | twisted | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115776 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 42.6 | none | twisted | twisted | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115877 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 17.1 | none | twisted | twisted | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115973 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 20.1 | none | faveosuite | faveo helpdesk | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115982 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 18.9 | none | n/a | phpipam | 2026-10-24 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87336 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115997 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 14.1 | none | pig-mesh | pig | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-60814 | NOISE | 16 | 0 | 25 | 40 | 3.9 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116136 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | projectsend | projectsend | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116137 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | cthackers | adm-zip | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116161 | NOISE | 16 | 0 | 25 | 40 | 6.0 | none | parse-community | parse-server | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116162 | NOISE | 16 | 0 | 25 | 40 | 2.1 | none | parse-community | parse-server | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116164 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | parse-community | parse-server | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116168 | NOISE | 16 | 0 | 25 | 40 | 6.2 | none | siyuan-note | siyuan | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116169 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | siyuan-note | siyuan | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116170 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | siyuan-note | siyuan | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116172 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | vllm-project | vllm | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116173 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | vllm-project | vllm | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116174 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | vllm-project | vllm | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115995 | NOISE | 16 | 10 | 0 | 45 | 9.6 | 71.9 | none | unitree robotics | unitree go2 | 2026-10-24 | no exploitation evidence in any monitored source | Upgrade Unitree Go2 firmware to version 1.1.11.5 or later (vendor package_1.1.11.5_GO2_Edu_Max_Pro_X). | |||
| CVE-2026-116205 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | yeswiki | yeswiki | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116206 | NOISE | 16 | 0 | 25 | 40 | 6.4 | none | yeswiki | yeswiki | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-17518 | NOISE | 16 | 0 | 33 | 30 | 8.2 | 3.6 | none | none | asus | router | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-116054 | NOISE | 16 | 0 | 25 | 40 | 2.2 | none | n/a | sh3 | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116057 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | kodcloud | kodexplorer | 2026-10-25 | no exploitation evidence in any monitored source | |||||
| CVE-2026-60869 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-60874 | NOISE | 16 | 0 | 25 | 40 | 4.2 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-60881 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-60882 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-60968 | NOISE | 16 | 0 | 25 | 40 | 6.0 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-70860 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | peoplesoft enterprise fin common objects argentina | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-85316 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91479 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 14.3 | none | none | oracle corporation | oracle database server | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-87345 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87348 | NOISE | 16 | 0 | 25 | 40 | 4.2 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87350 | NOISE | 16 | 0 | 25 | 40 | 4.5 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83371 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | oracle corporation | oracle hrms (uk) | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-92387 | NOISE | 16 | 0 | 25 | 40 | 22.4 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83375 | NOISE | 16 | 0 | 25 | 40 | 6.0 | none | oracle corporation | peoplesoft enterprise hcm human resources | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83382 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | oracle corporation | oracle report manager | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83383 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle hrms (us) | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115357 | NOISE | 16 | 0 | 25 | 40 | 2.2 | 11.1 | none | openbao | openbao | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-83384 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle hrms (us) | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83385 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle hrms (us) | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115486 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 10.7 | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-19678 | NOISE | 16 | 10 | 13 | 30 | 8.7 | 32.4 | none | onphase | onphase forms | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to 11.0.17, which removes the unauthenticated registration endpoint, sandboxes rules, and disables the Document Service endpoint (/service) by default. | |||
| CVE-2026-83386 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle hrms (us) | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-89313 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 13.3 | none | eclipse foundation | eclipse keypont – gose | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115724 | NOISE | 16 | 0 | 25 | 40 | 2.9 | 0.4 | none | videolan | vlc for android | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-83394 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | oracle corporation | oracle demand planning | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87291 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | oracle java se | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87292 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87298 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87358 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | oracle corporation | oracle general ledger | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87366 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | oracle corporation | oracle applications framework | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91271 | NOISE | 16 | 7 | 1 | 49 | 8.1 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87365 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87361 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87360 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114060 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 5.4 | none | none | sveltejs | kit | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-112991 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 22.7 | none | none | misp | misp-modules | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-110322 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 1.4 | none | hms networks | peak-system device driver setup · pcan windows can device drivers | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113609 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | none | bandisoft | bandizip | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111066 | NOISE | 16 | 0 | 25 | 40 | 8.2 | 30.7 | none | none | aio-libs | aiohttp | 2026-10-19 | no exploitation evidence in any monitored source | Upgrade aiohttp to version 3.14.4 or later. | ||
| CVE-2026-13411 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | mattermost | mattermost | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2025-60480 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 12.2 | none | none | n/a | n/a | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-92205 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 23.1 | none | busybox | busybox | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101695 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 26.9 | none | none | oracle corporation | oracle one-to-one fulfillment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-92204 | NOISE | 16 | 0 | 25 | 40 | 7.7 | 34.7 | none | airbyte | airbyte | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76739 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 6.8 | none | none | hewlett packard enterprise | hpe compute scale-up server 3200 platform · hpe compute scale-up server 3250 platform · hpe superdome flex server | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-113730 | NOISE | 16 | 0 | 25 | 40 | 5.6 | 28.3 | none | none | orphan-oss | ognl | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-114459 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 19.4 | none | none | pbuchbinder | mod_qos | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114129 | NOISE | 16 | 0 | 25 | 40 | 6.2 | 2.8 | none | uhop | stream-json | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107929 | NOISE | 16 | 0 | 25 | 40 | 20.5 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114457 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 19.4 | none | none | pbuchbinder | mod_qos | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-41114 | NOISE | 16 | 0 | 25 | 40 | 15.1 | none | apache software foundation | apache iotdb jdbc driver | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110363 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | thimpress | learnpress | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-59229 | NOISE | 16 | 0 | 25 | 40 | 16.2 | none | apache software foundation | apache iotdb | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115385 | NOISE | 16 | 0 | 25 | 40 | 6.2 | none | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112892 | NOISE | 16 | 0 | 25 | 40 | 8.7 | 20.6 | none | none | python-pillow | pillow | 2026-10-19 | no exploitation evidence in any monitored source | Upgrade Pillow to version 13.0.0 or later, which fixes the MSP RLE decoder expansion issue. | ||
| CVE-2026-113596 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 28.5 | none | none | webstudio-is | webstudio | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-61902 | NOISE | 16 | 0 | 25 | 40 | 4.6 | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||||
| CVE-2026-89316 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 10.7 | none | eclipse foundation | eclipse keypont – gose | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113795 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 39.3 | none | py-pdf | pypdf | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101375 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101376 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | none | oracle corporation | oracle rest data services | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112254 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | agit8or1 | clientst0r | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114049 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 17.4 | none | vllm-project | vllm | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114046 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 16.0 | none | freerdp | freerdp | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114223 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 0.3 | none | newtype infortech | nt oneapp | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112835 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 8.6 | none | none | e4jvikwp | vikrentcar | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-111401 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 4.0 | none | none | tailored media | tailored tools | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-111407 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | themeum | tutor lms | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91431 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 1.2 | none | none | oracle corporation | siebel crm end user | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-112825 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 19.6 | none | none | magepeople inc. | car rental manager | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-101391 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101392 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101393 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101396 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101462 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101621 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87299 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101627 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101401 | NOISE | 16 | 0 | 25 | 40 | 2.9 | 4.4 | none | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101402 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 27.4 | none | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101404 | NOISE | 16 | 0 | 25 | 40 | 3.9 | 2.8 | none | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-112396 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 38.8 | none | none | python-pillow | pillow | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-112937 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | tox-dev | filelock | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-94023 | NOISE | 16 | 0 | 25 | 40 | 6.9 | none | none | eclipse foundation | eclipse threadx | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-94024 | NOISE | 16 | 0 | 25 | 40 | 6.9 | none | none | eclipse foundation | eclipse threadx | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-95107 | NOISE | 16 | 0 | 25 | 40 | 7.0 | none | none | eclipse foundation | eclipse threadx | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-94202 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | none | eclipse foundation | eclipse threadx | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113359 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | baserow | baserow | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-66281 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 20.8 | none | none | silicon labs | emberznet | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-66282 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 21.8 | none | none | silicon labs | emberznet | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-85080 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 39.6 | none | none | silicon labs | emberznet | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-112178 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 12.9 | none | none | misp | misp | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-101643 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | oracle corporation | oracle sales online | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101649 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | oracle corporation | oracle partner management | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108762 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache kylin | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-63243 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 10.4 | none | creative labs | creative sound blaster katana v2, v2x, se | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101650 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | oracle corporation | oracle partner management | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101651 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | oracle partner management | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-64944 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache answer | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-101662 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | oracle corporation | oracle mobile field service | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101667 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | oracle corporation | oracle trade management | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87376 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | oracle corporation | webcenter content: imaging | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115221 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 3.7 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-115449 | NOISE | 16 | 0 | 25 | 40 | 3.5 | 14.9 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 8 · red hat enterprise linux 9 +1 more | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-112361 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 20.8 | none | none | n/a | dolibarr | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-83531 | NOISE | 16 | 12 | 33 | 5 | 8.8 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: total technical impact | Upgrade to 4.23.0; on the 4.22.x stream upgrade to 4.22.1 and on 4.18.x to 4.18.5. 4.14.x and earlier are end-of-life and will not be fixed. | |||
| CVE-2026-87303 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | oracle vm virtualbox | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112328 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | automattic | sensei lms | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87375 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | oracle corporation | webcenter content: imaging | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87328 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87330 | NOISE | 16 | 0 | 25 | 40 | 4.2 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86413 | NOISE | 16 | 0 | 25 | 40 | 22.8 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115394 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 5.7 | none | none | nationalsecurityagency | ghidra | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-87400 | NOISE | 16 | 0 | 25 | 40 | 6.9 | none | none | oracle corporation | oracle webcenter content | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91511 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | oracle corporation | oracle purchasing | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91514 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | oracle bi publisher | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110306 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 9.8 | none | none | fast-uri | fast-uri | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113349 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 10.4 | none | none | opencats | opencats | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113351 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | libexpat | libexpat | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-18205 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | ticimax informatics technologies inc. | ticimax e-commerce platform | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91477 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 13.5 | none | none | oracle corporation | oracle javafx | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-80353 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache tomcat | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-113472 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 14.2 | none | none | unknown | depicter — popup & slider builder | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-113650 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | apostrophecms | apostrophe · sanitize-html | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91565 | NOISE | 16 | 0 | 25 | 40 | 6.4 | none | none | oracle corporation | oracle agile product lifecycle management for process | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113723 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 3.2 | none | pypa | virtualenv | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113724 | NOISE | 16 | 0 | 25 | 40 | 4.5 | 1.6 | none | pypa | virtualenv | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-86410 | NOISE | 16 | 0 | 25 | 40 | 18.9 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86411 | NOISE | 16 | 0 | 25 | 40 | 3.0 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86412 | NOISE | 16 | 0 | 25 | 40 | 20.5 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2012-20002 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 44.4 | none | james charlesworth | tinymce thumbnail gallery | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-11960 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 17.0 | none | none | facturascripts | facturascripts | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-111758 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 38.5 | none | markdown-it | markdown-it | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114190 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 23.2 | none | none | hai zheng / lite speed cache | litespeed cache | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-114179 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 9.9 | none | none | wordplus | bp better messages | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2026-91427 | NOISE | 16 | 0 | 25 | 40 | 2.3 | 4.0 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91426 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 3.3 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91424 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 7.4 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-95717 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 18.3 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-95713 | NOISE | 16 | 0 | 25 | 40 | 7.0 | 21.7 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-86414 | NOISE | 16 | 0 | 25 | 40 | 20.5 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-95712 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 14.6 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-87861 | NOISE | 16 | 0 | 25 | 40 | 20.5 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87862 | NOISE | 16 | 0 | 25 | 40 | 20.5 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87863 | NOISE | 16 | 0 | 25 | 40 | 20.5 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87864 | NOISE | 16 | 0 | 25 | 40 | 10.2 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87866 | NOISE | 16 | 0 | 25 | 40 | 7.3 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-92386 | NOISE | 16 | 0 | 25 | 40 | 20.5 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-92388 | NOISE | 16 | 0 | 25 | 40 | 20.5 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-92390 | NOISE | 16 | 0 | 25 | 40 | 20.5 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-92391 | NOISE | 16 | 0 | 25 | 40 | 19.5 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105963 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 43.2 | none | none | elixir-plug | plug_crypto | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-94265 | NOISE | 16 | 0 | 25 | 40 | 24.9 | none | curl | curl | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101405 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101406 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | oracle corporation | siebel apps – marketing | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101407 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | oracle corporation | peoplesoft enterprise peopletools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101754 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 25.7 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101741 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 7.3 | none | none | oracle corporation | oracle agile engineering data management | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101722 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 21.0 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101721 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 37.2 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-114214 | NOISE | 16 | 0 | 25 | 40 | 6.0 | none | none | ash-project | ash | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116056 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | none | kodcloud | kodexplorer | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116175 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | vllm-project | vllm | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116159 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116158 | NOISE | 16 | 0 | 25 | 40 | 2.5 | none | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116157 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | none | imagemagick | imagemagick | 2026-10-25 | no exploitation evidence in any monitored source | ||||
| CVE-2026-83361 | NOISE | 16 | 7 | 1 | 49 | 8.1 | none | oracle corporation | oracle contract lifecycle management for public sector | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101815 | NOISE | 16 | 0 | 25 | 40 | 7.6 | 22.7 | none | none | oracle corporation | assets | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-115381 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115379 | NOISE | 16 | 0 | 25 | 40 | 5.7 | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-104679 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 2.3 | none | none | yamaha corporation | vocaloid6 editor | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-101821 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 11.0 | none | none | oracle corporation | oracle compensation workbench | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101792 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 7.1 | none | none | oracle corporation | oracle communications brm – elastic charging engine | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91481 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 9.1 | none | none | oracle corporation | peoplesoft enterprise scm purchasing | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101780 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 32.3 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101778 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 32.3 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101777 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 32.0 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2020-37284 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | midgetspy | sickbeard | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101822 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 18.1 | none | none | oracle corporation | oracle bills of material | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-114386 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 26.9 | none | none | pydantic | pydantic-ai-harness | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-116046 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 3.1 | none | none | eventcatalog | sdk | 2026-10-25 | no exploitation evidence in any monitored source | |||
| CVE-2026-115183 | NOISE | 16 | 0 | 25 | 40 | 2.4 | 0.7 | none | none | unknown | qi addons for elementor | 2026-10-25 | no exploitation evidence in any monitored source | |||
| CVE-2026-114740 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 6.1 | none | none | unknown | wpvr | 2026-10-25 | no exploitation evidence in any monitored source | |||
| CVE-2026-111981 | NOISE | 16 | 0 | 25 | 40 | 2.7 | 2.8 | none | none | unknown | givewp | 2026-10-25 | no exploitation evidence in any monitored source | |||
| CVE-2026-111980 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 2.8 | none | none | unknown | givewp | 2026-10-25 | no exploitation evidence in any monitored source | |||
| CVE-2025-15705 | NOISE | 16 | 0 | 25 | 40 | 3.5 | 4.4 | none | none | unknown | contact form by supsystic | 2026-10-25 | no exploitation evidence in any monitored source | |||
| CVE-2026-91461 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 8.3 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91455 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 13.1 | none | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-78117 | NOISE | 16 | 0 | 25 | 40 | 4.2 | 5.2 | none | none | zephyrproject | zephyr | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-115897 | NOISE | 16 | 0 | 25 | 40 | 2.1 | 23.2 | none | none | yahoo | serialize-javascript | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-91441 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 8.8 | none | none | oracle corporation | siebel apps – customer order management | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91439 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 2.8 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91436 | NOISE | 16 | 0 | 25 | 40 | 3.9 | 1.4 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91430 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 12.0 | none | none | oracle corporation | siebel apps – financial services | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91415 | NOISE | 16 | 0 | 25 | 40 | 7.0 | 14.9 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91414 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 20.7 | none | none | oracle corporation | siebel crm deployment | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-91413 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 25.0 | none | none | oracle corporation | siebel crm development | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-55222 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 2.3 | none | none | ilbers | isar | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-95721 | NOISE | 16 | 0 | 25 | 40 | 3.3 | 1.5 | none | none | hewlett packard enterprise (hpe) | arubaos (aos) | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-57208 | NOISE | 16 | 0 | 25 | 40 | 6.2 | 31.8 | none | none | entireio | cli | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-115754 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 13.8 | none | none | yahoo | serialize-javascript | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-86020 | NOISE | 16 | 0 | 25 | 40 | 4.6 | 4.5 | none | none | part-db | part-db-server | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-113876 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 21.9 | none | none | smilecdr | hapi fhir | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-112837 | NOISE | 16 | 0 | 25 | 40 | 8.5 | 23.1 | none | none | ruben garcia | gamipress | 2026-10-23 | no exploitation evidence in any monitored source | Update the GamiPress WordPress plugin to version 8.0.8 or later. | ||
| CVE-2026-112849 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 8.6 | none | none | aivahthemes | hostme v2 | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-115390 | NOISE | 16 | 0 | 25 | 40 | 5.7 | 15.3 | none | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-115386 | NOISE | 16 | 0 | 25 | 40 | 2.6 | 9.4 | none | none | bytecodealliance | wasmtime | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-115364 | NOISE | 16 | 0 | 25 | 40 | 2.2 | 24.1 | none | none | openbao | openbao | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114638 | NOISE | 16 | 0 | 25 | 40 | 8.7 | 12.3 | none | none | traefik | traefik | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to Traefik 3.7.14 or later; versions 3.7.0 through 3.7.13 are affected. | ||
| CVE-2026-114634 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 15.9 | none | none | wwbn | avideo | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114515 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 18.7 | none | none | schorschii | oco-server | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114492 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 43.3 | none | none | flipped-aurora | gin-vue-admin | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-114128 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 24.9 | none | none | withastro | astro | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-114124 | NOISE | 16 | 0 | 25 | 40 | 3.9 | 8.1 | none | none | electron | electron | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-113800 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 15.1 | none | none | electron | electron | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-113796 | NOISE | 16 | 0 | 25 | 40 | 4.2 | 12.2 | none | none | electron | electron | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-109198 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 31.5 | none | none | cleantalk | cleantalk anti-spam – complete spam protection | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-109934 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 20.5 | none | none | unknown | otter blocks | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-110537 | NOISE | 16 | 0 | 25 | 40 | 3.8 | 15.5 | none | none | unknown | essential addons for elementor | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-112230 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 10.5 | none | none | unknown | popup builder | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-111965 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 17.8 | none | none | unknown | profile builder | 2026-10-23 | no exploitation evidence in any monitored source | |||
| CVE-2026-114082 | NOISE | 16 | 0 | 25 | 40 | 8.1 | 18.8 | none | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade Trigger.dev to 4.6.2 or later; versions before 4.6.2 are affected. | ||
| CVE-2026-114072 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 0.9 | none | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-101830 | NOISE | 16 | 0 | 25 | 40 | 7.7 | 28.0 | none | none | oracle corporation | oracle project contracts | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101828 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 28.0 | none | none | oracle corporation | oracle mobile application server | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-84727 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 24.0 | none | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-87849 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 4.7 | none | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-90484 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 4.1 | none | none | apache software foundation | apache brpc | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-113716 | NOISE | 16 | 0 | 25 | 40 | 4.5 | 1.6 | none | none | pypa | virtualenv | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113720 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 1.0 | none | none | pypa | virtualenv | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-114716 | NOISE | 16 | 0 | 25 | 40 | 8.5 | 31.9 | none | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to Roundcube Webmail 1.6.20 or later, or 1.7.5 or later for the 1.7.x branch. | ||
| CVE-2026-114720 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 56.3 | none | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114725 | NOISE | 16 | 0 | 25 | 40 | 5.0 | 20.0 | none | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114717 | NOISE | 16 | 0 | 25 | 40 | 4.0 | 21.3 | none | none | roundcube | webmail | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-114399 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 42.7 | none | none | polonel | trudesk | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-114050 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 6.0 | none | none | vllm-project | vllm | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-114370 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 24.0 | none | none | red hat | red hat build of apache camel for spring boot 4 · red hat enterprise linux 8 · red hat enterprise linux 9 +5 more | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-114075 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114070 | NOISE | 16 | 0 | 25 | 40 | 3.5 | none | none | triggerdotdev | trigger.dev | 2026-10-21 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91629 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | none | oracle corporation | oracle communications billing and revenue management | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91376 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | oracle corporation | primavera p6 enterprise project portfolio management | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91375 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | none | oracle corporation | oracle java se | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91374 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | none | oracle corporation | oracle java se · oracle graalvm for jdk · oracle graalvm enterprise edition | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87423 | NOISE | 16 | 0 | 25 | 40 | 4.5 | none | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107568 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 14.7 | none | none | progressive robot ltd | hmailserver | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-107566 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 7.3 | none | none | progressive robot ltd | hmailserver | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-107187 | NOISE | 16 | 0 | 25 | 40 | 8.5 | 18.7 | none | none | eptura | archibus | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-105815 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 10.2 | none | none | tp-link systems inc. | tapo c210 v3.6 | 2026-10-19 | no exploitation evidence in any monitored source | |||
| CVE-2026-113608 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | jleyva | moodle-block_configurablereports | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113357 | NOISE | 16 | 0 | 25 | 40 | 3.5 | none | none | tester-army | @e2e-dev/github | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112148 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 27.9 | none | none | ly corporation | liff sdk | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113680 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | harfbuzz | harfbuzz | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110095 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 13.2 | none | none | fast-uri | fast-uri | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-110180 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 10.4 | none | none | fast-uri | fast-uri | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101201 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 2.1 | none | none | qt | qt | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-112948 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | vitest-dev, @vitest | vitest · browser · ui +1 more | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112943 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | none | vitejs | launch-editor · vite-plus | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112944 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | none | vitejs | launch-editor · vite-plus | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112957 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | apostrophecms | apostrophe | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112955 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | apostrophecms, @apostrophecms | apostrophe · import-export | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112952 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | apostrophecms | apostrophe | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107597 | NOISE | 16 | 0 | 25 | 40 | 5.1 | none | none | eclipse foundation | eclipse csi – pia | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-92446 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | none | eclipse foundation | eclipse threadx – guix | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-95108 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | none | eclipse foundation | eclipse threadx | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111763 | NOISE | 16 | 0 | 25 | 40 | 5.7 | none | none | a2aproject | a2a-java | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-95111 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | none | eclipse foundation | eclipse threadx | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113465 | NOISE | 16 | 0 | 25 | 40 | 6.6 | 7.4 | none | none | stormshield | stormshield network security | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-90799 | NOISE | 16 | 0 | 25 | 40 | 1.3 | none | none | apache software foundation | apache couchdb | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-90798 | NOISE | 16 | 0 | 25 | 40 | 0.6 | none | none | apache software foundation | apache couchdb | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113402 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 28.7 | none | none | armorx global technology | armorx spam | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-113382 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | none | arizu-id | fast-tunnel | 2026-10-20 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101782 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 28.0 | none | none | oracle corporation | oracle applications manager | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-84178 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101788 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 27.5 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101756 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 35.4 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101755 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 23.0 | none | none | oracle corporation | mysql server · mysql cluster | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-101438 | NOISE | 15 | 2 | 6 | 50 | 8.0 | none | oracle corporation | siebel crm cloud applications | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112407 | NOISE | 15 | 5 | 18 | 30 | 8.8 | 26.8 | none | aws | cicd-toolchain-for-serverless-applications | 2026-10-20 | no exploitation evidence in any monitored source | Upgrade existing toolchain stacks to version 1.0.11 or later. | |||
| CVE-2026-113812 | NOISE | 15 | 0 | 10 | 50 | 4.0 | none | affected product not stated | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-91326 | NOISE | 15 | 4 | 1 | 49 | 8.8 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-79982 | NOISE | 15 | 0 | 13 | 45 | 8.8 | 13.6 | none | zephyrproject | zephyr | 2026-10-23 | no exploitation evidence in any monitored source | Apply the upstream patch (commit 0419defd2391652edc27689d206fcd9c48439d4a, GHSA-w5px-w97v-c3hj), which adds a separate bt_hci_tx_pool sized to MAX(BT_BUF_ACL_RX_SIZE, BT_BUF_EVT_RX_SIZE) for controller-to-host packets. | |||
| CVE-2026-94140 | NOISE | 15 | 0 | 10 | 50 | 15.7 | none | affected product not stated | 2026-10-21 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-112921 | NOISE | 15 | 0 | 10 | 50 | 13.0 | none | affected product not stated | 2026-10-21 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-115803 | NOISE | 15 | 0 | 20 | 40 | 4.3 | 12.7 | none | none | n/a | scada-lts | 2026-10-24 | no exploitation evidence in any monitored source | |||
| CVE-2025-30049 | NOISE | 15 | 0 | 13 | 45 | 8.2 | 11.0 | none | cgm | cgm clininet | 2026-10-23 | no exploitation evidence in any monitored source | Fixed in CGM CLININET versions 2026.MS1 and 2026.MS3; upgrade to one of these releases. | |||
| CVE-2026-114353 | NOISE | 14 | 0 | 25 | 30 | 7.0 | 4.6 | none | dji | crystalsky zs600c | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79976 | NOISE | 14 | 0 | 25 | 30 | 7.1 | 17.1 | none | none | zephyrproject | zephyr | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-96616 | NOISE | 14 | 0 | 25 | 30 | 6.5 | 30.8 | none | none | kiloview | e3 firmware | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-91287 | NOISE | 14 | 2 | 0 | 50 | 8.1 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105265 | NOISE | 14 | 0 | 25 | 30 | 5.3 | 32.5 | none | none | kiloview | e3 firmware | 2026-10-22 | no exploitation evidence in any monitored source | |||
| CVE-2026-91286 | NOISE | 14 | 2 | 1 | 49 | 8.2 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114356 | NOISE | 14 | 0 | 25 | 30 | 7.0 | 1.8 | none | dji | crystalsky zs600c | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-88900 | NOISE | 14 | 12 | 25 | 5 | 8.8 | none | none | apache software foundation | apache camel | 2026-10-19 | CISA SSVC: total technical impact | Upgrade to 4.23.0; on the 4.22.x stream upgrade to 4.22.1 and on the 4.18.x stream to 4.18.5. Earlier and EOL lines (4.14.x and earlier, 4.15.x-4.17.x, 4.19.x-4.21.x) will not be fixed. | |||
| CVE-2026-108089 | NOISE | 14 | 13 | 25 | 5 | 7.5 | none | none | apache software foundation | apache cocoon | 2026-10-20 | CISA SSVC: automatable | ||||
| CVE-2026-100737 | NOISE | 14 | 0 | 25 | 30 | 6.9 | 10.7 | none | none | atsumi electric co., ltd. | adx5004 · adx5008 · adx404 +7 more | 2026-10-20 | no exploitation evidence in any monitored source | |||
| CVE-2026-87322 | NOISE | 14 | 3 | 1 | 50 | 8.4 | none | oracle corporation | oracle vm virtualbox | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-92450 | NOISE | 14 | 0 | 25 | 30 | 7.5 | 31.2 | none | kiloview | e3 firmware | 2026-10-22 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112202 | NOISE | 13 | 0 | 10 | 40 | 13.0 | none | affected product not stated | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-91348 | NOISE | 13 | 0 | 0 | 50 | 8.4 | none | oracle corporation | oracle solaris | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113877 | NOISE | 13 | 0 | 10 | 40 | 31.5 | none | affected product not stated | 2026-10-23 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-115938 | NOISE | 13 | 5 | 13 | 30 | 8.8 | 30.5 | none | craftcms | cms | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to Craft CMS 5.11.2 or later (5.x), or 4.18.9 or later (4.x). | |||
| CVE-2026-114629 | NOISE | 13 | 0 | 10 | 40 | 18.6 | none | affected product not stated | 2026-10-24 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-111879 | NOISE | 13 | 0 | 10 | 40 | 6.9 | none | affected product not stated | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-108518 | NOISE | 13 | 0 | 10 | 40 | 12.9 | none | affected product not stated | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-110674 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-110675 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-115824 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-25 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-94423 | NOISE | 13 | 0 | 10 | 40 | 18.1 | none | affected product not stated | 2026-10-21 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-115825 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-25 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-110673 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-110672 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-111946 | NOISE | 13 | 0 | 10 | 40 | 6.0 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-115817 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-25 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-110688 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-110687 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-115822 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-25 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-115823 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-25 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-110686 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-110685 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-110684 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-110682 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-110681 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-110680 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-110678 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-110677 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-110676 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-19 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-85783 | NOISE | 13 | 0 | 10 | 40 | 11.5 | none | affected product not stated | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-114354 | NOISE | 13 | 0 | 0 | 50 | 8.6 | 2.6 | none | dji | crystalsky zs600c | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113811 | NOISE | 13 | 0 | 10 | 40 | 13.0 | none | affected product not stated | 2026-10-21 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-107588 | NOISE | 13 | 5 | 13 | 30 | 8.4 | 43.6 | none | vaadin | vaadin-charts-flow-svg-generator | 2026-10-21 | no exploitation evidence in any monitored source | Upgrade to Vaadin 23.6.16, 24.4.24, 24.7.16, 24.9.23, 24.10.11, 25.2.10, or 25.3.1 or newer; the fix applies Highsoft’s recommended workarounds to the bundled Highcharts. | |||
| CVE-2026-91355 | NOISE | 13 | 0 | 1 | 49 | 8.4 | none | oracle corporation | oracle outside in technology | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114355 | NOISE | 13 | 0 | 0 | 50 | 8.6 | 68.1 | none | dji | crystalsky zs600c | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91266 | NOISE | 13 | 0 | 1 | 49 | 8.4 | none | oracle corporation | jd edwards enterpriseone tools | 2026-10-20 | no exploitation evidence in any monitored source | |||||
| CVE-2025-30047 | NOISE | 11 | 0 | 13 | 30 | 9.4 | 31.6 | none | cgm | cgm clininet | 2026-10-23 | no exploitation evidence in any monitored source | Upgrade to CGM CLININET version 2026.MS3 or later. | |||
| CVE-2025-30050 | NOISE | 11 | 0 | 13 | 30 | 9.4 | 12.7 | none | cgm | cgm clininet | 2026-10-23 | no exploitation evidence in any monitored source | Fixed in CGM CLININET version 2026.MS3; upgrade to 2026.MS3 or later. | |||
| CVE-2026-115812 | NOISE | 10 | 11 | 18 | 0 | 9.8 | 44.5 | none | aws | multi-model-server | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114519 | NOISE | 10 | 5 | 0 | 30 | 8.6 | 29.2 | none | roskus | prospero flow crm | 2026-10-22 | no exploitation evidence in any monitored source | Upgrade to Roskus Prospero Flow CRM 5.26.0 or later. | |||
| CVE-2026-115813 | NOISE | 9 | 0 | 30 | 5 | 5.8 | 29.1 | none | aws | multi-model-server | 2026-10-23 | no exploitation evidence in any monitored source | ||||
| CVE-2026-78119 | NOISE | 8 | 0 | 25 | 5 | 6.3 | 3.6 | none | none | zephyrproject | zephyr | 2026-10-21 | no exploitation evidence in any monitored source | |||
| CVE-2026-78163 | NOISE | 8 | 0 | 25 | 5 | 5.9 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108087 | NOISE | 8 | 0 | 25 | 5 | none | apache software foundation | apache cocoon | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-74049 | NOISE | 8 | 0 | 25 | 5 | none | apache software foundation | apache tomcat | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-108088 | NOISE | 8 | 0 | 25 | 5 | none | apache software foundation | apache cocoon | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-108086 | NOISE | 8 | 0 | 25 | 5 | none | apache software foundation | apache cocoon | 2026-10-20 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-38671 | NOISE | 8 | 0 | 25 | 5 | 6.1 | none | none | n/a | n/a | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113582 | NOISE | 8 | 1 | 25 | 5 | 7.5 | none | apache software foundation | apache abdera | 2026-10-22 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91858 | NOISE | 8 | 0 | 25 | 5 | 6.5 | none | none | apache software foundation | apache camel | 2026-10-19 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110974 | NOISE | 8 | 0 | 25 | 5 | 6.3 | 15.8 | none | vaadin | android-json | 2026-10-22 | no exploitation evidence in any monitored source |
About this brief
Quatronics began publishing this brief when CISA retired its Weekly Vulnerability Bulletin on
28 September 2026. CISA continues to publish the KEV catalogue and its cybersecurity advisories; this brief is
not affiliated with or endorsed by CISA. Every input is a public, official source: the CVE Program, the NIST
National Vulnerability Database, CISA KEV and SSVC decision points, FIRST EPSS, and the public Metasploit,
Exploit-DB and nuclei repositories. Prioritisation weights those signals against deployment breadth and
remediation cost, and every entry is reviewed by a Quatronics analyst before publication.
