9 items require immediate action; PHP pre-auth RCE dominates
November 2, 2026 · covering 2026-10-26 to 2026-11-02 (through 13:55 ET)
9require immediate attention
73should be reviewed
614high-CVSS, low real-world priority
3555assessed this week
9new CISA KEV additions
PHP suffered two critical pre-auth remote code execution flaws added to CISA KEV this week with near-certain exploitation likelihood (EPSS 0.99999), alongside active exploitation of Brotli, GitLab, Linux kernel, Adobe Commerce, Ivanti Connect Secure, and Cisco ASA/FTD. Nine items require immediate patching; the remainder of the week is routine.
847 records lack enrichment; treat REVIEW and DO_NOT_PANIC sections as preliminary until scoring completes.
New KEV additions this week
Added to CISA’s Known Exploited Vulnerabilities catalog during this window, whatever the
published date. Entries an earlier brief already shipped reappear here because the KEV listing itself is new.
| CVE | Tier | Vendor | Product | KEV added | KEV due | Ransomware | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-109619 | ACT_NOW | php, siemens | php, ruggedcom_ape1808_firmware | 2026-10-26 | 2026-10-29 | 2026-10-21 | |
| CVE-2026-109618 | ACT_NOW | php, siemens | php, ruggedcom_ape1808_firmware | 2026-10-26 | 2026-10-29 | 2026-10-21 | |
| CVE-2026-111497 | ACT_NOW | google, nodejs | brotli, node.js | 2026-10-27 | 2026-11-10 | 2026-10-22 | |
| CVE-2026-97229 | ACT_NOW | gitlab | gitlab | 2026-10-29 | 2026-11-01 | 2026-10-13 | |
| CVE-2026-46300 | ACT_NOW | linux, siemens | linux_kernel, simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware | 2026-10-28 | 2026-10-31 | 2026-05-23 | |
| CVE-2026-48356 | ACT_NOW | adobe | commerce, commerce_b2b | 2026-10-27 | 2026-11-10 | 2026-07-14 | |
| CVE-2026-111357 | ACT_NOW | ivanti | connect_secure, connect secure | 2026-10-30 | 2026-11-02 | 2026-10-15 | |
| CVE-2026-76418 | ACT_NOW | cisco | adaptive_security_appliance_software, secure_firewall_threat_defense | 2026-10-29 | 2026-11-01 | 2026-10-28 | |
| CVE-2026-41709 | ACT_NOW | vmware | esxi, cloud_foundation | 2026-10-28 | 2026-11-11 | 2026-07-30 |
Complete data — all vulnerabilities new or updated this week
Sorted by Quatronics priority score. Threat, Reach and Effort are the three axes behind it.
Effort is inverted: 100 means the fix is trivial.
| CVE | Tier | Priority | Threat | Reach | Effort | CVSS | EPSS %ile | KEV | SSVC | Exploit artifacts | Evidence class | Vendor | Affected versions | Published | Assessment | Recommended action |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CVE-2026-109619 | ACT_NOW | 95 | 100 | 100 | 80 | 8.1 | 100.0 | Yes | active | cisa_only | php, siemens | php · ruggedcom_ape1808_firmware · pan-os 10.2.7, 10.2.8, 10.2.9, 10.2.10 +19 more | 2026-10-21 | PHP is ubiquitous and this is a pre-auth remote code execution flaw with active exploitation confirmed in CISA KEV, an EPSS score of 0.99999, and no authentication required on internet-facing deployments. | Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart workers. If you cannot update immediately, set fatal_error_backtraces=0 and restart all workers as a partial mitigation only, then patch. | |
| CVE-2026-109618 | ACT_NOW | 95 | 100 | 100 | 80 | 9.8 | 100.0 | Yes | active | EDB✓ nuclei | confirmed_exploited | php, siemens | php · ruggedcom_ape1808_firmware · pan-os 10.2.7, 10.2.8, 10.2.9, 10.2.10 +19 more | 2026-10-21 | PHP OOM handling leaves request memory uninitialized, giving unauthenticated remote code execution; CISA KEV-listed with active exploitation, EPSS 0.99999, and a verified ExploitDB entry. PHP is ubiquitous and often internet-facing. | Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart all PHP workers. If you cannot update immediately, set memory_limit=-1 and restart workers as an incomplete stopgap, and inventory embedded PHP in PAN-OS and Siemens/RuggedCom firmware against vendor advisories. |
| CVE-2026-111497 | ACT_NOW | 91 | 100 | 100 | 65 | 9.8 | 99.7 | Yes | active | cisa_only | google, nodejs | node.js · brotlicffi · .net 11.0.0 +20 more | 2026-10-22 | CISA KEV-listed with active exploitation, EPSS 0.826 (99.7th percentile), CVSS 9.8, and no authentication required; Brotli is embedded in Node.js, .NET, Istio and Debian, so the vulnerable decoder is likely already in your stack. | Inventory Brotli 1.0.3–1.2.0 across apps, containers and dependencies; upgrade to 1.0.10, 1.1.1 or 1.2.1. For .NET, install the updated runtime/SDK and restart affected apps. Prioritise internet-facing services per BOD 26-04. | |
| CVE-2026-97229 | ACT_NOW | 86 | 100 | 78 | 65 | 10.0 | 98.0 | Yes | active | MSF:400 | confirmed_exploited | gitlab | gitlab | 2026-10-13 | Unauthenticated remote code execution in GitLab CE/EE via a crafted CI/CD regex, actively exploited and on CISA KEV with a forensic-triage requirement; CVSS 10.0 and a public Metasploit module exist. | Upgrade GitLab CE/EE to 19.2.8, 19.3.5, 19.4.2 or later and restart the service. Until patched, restrict GitLab to trusted networks and review CI/CD configuration changes for suspicious regular expressions. |
| CVE-2026-46300 | ACT_NOW | 85 | 100 | 80 | 60 | 7.8 | 96.9 | Yes | active | MSF:500 EDB | confirmed_exploited | linux, siemens | linux_kernel 7.1 · simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware · openshift_container_platform +16 more | 2026-05-23 | CISA KEV-listed with active exploitation per SSVC, and it affects the ubiquitous Linux kernel; local access with low privileges is enough to reach total technical impact, and a Metasploit module exists. | Patch the kernel to your distribution’s fixed build (Red Hat: kernel 0:6.12.0-211.8.el10nv or 0:6.12.0-231.12.el10nv) or apply upstream commit 3599e6b3cc1ada96883d496a50a210d3afbb6987; schedule the required reboot and complete BOD 26-04 forensic triage. |
| CVE-2026-48356 | ACT_NOW | 83 | 98 | 80 | 55 | 9.3 | 98.8 | Yes | active | cisa_only | adobe | i\/o_events · adobe commerce b2b · magento open source +1 more | 2026-07-14 | Adobe Commerce file-upload flaw allowing arbitrary code execution is in CISA KEV with active exploitation, EPSS 0.31 (98th percentile), and affects internet-facing storefronts that are commonly deployed. | Apply the July 2026 Adobe Commerce security update (APSB26-73): 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul or 2.4.4-2026-jul, plus matching B2B/Magento releases. Plan for downtime and follow BOD 26-04 triage guidance. | |
| CVE-2026-111357 | ACT_NOW | 78 | 88 | 70 | 65 | 7.0 | 24.6 | Yes | active | cisa_only | ivanti | connect_secure 22.8 · connect secure | 2026-10-15 | Ivanti Connect Secure privilege escalation to root, described as exploited in the wild in October 2026 and added to CISA KEV with a BOD 26-04 forensic-triage requirement. | Apply the Ivanti fix per the security advisory at hub.ivanti.com (no fixed version named in this record); expect a service restart. Until patched, restrict management access to trusted networks and run the BOD 26-04 forensic triage on exposed appliances. | |
| CVE-2026-76418 | ACT_NOW | 78 | 85 | 88 | 55 | 8.6 | 59.9 | Yes | active | cisa_only | cisco | adaptive_security_appliance_software 9.24.10 · cisco secure firewall adaptive security appliance (asa) software · cisco secure firewall threat defense (ftd) software | 2026-10-28 | Unauthenticated, internet-facing DoS against Cisco ASA/FTD SSL VPN: a crafted request reloads the device, and CISA added it to KEV on 2026-10-29. EPSS is low (0.0091) and no public exploit code is recorded, so urgency rests on KEV listing and exposure. | Update ASA and FTD to the first fixed releases listed in the Fixed Software section of Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75; schedule the reload window. Until patched, restrict SSL VPN access to trusted sources or disable secondary authentication on tunnel groups where feasible. | |
| CVE-2026-41709 | ACT_NOW | 70 | 70 | 85 | 55 | 2.7 | 52.7 | Yes | active | cisa_only | vmware | esxi 8.0 · cloud_foundation · telco_cloud_platform +4 more | 2026-07-30 | CISA added it to KEV with active exploitation reported, but the attacker must already be a privileged ESXi administrator and the impact is unlogged operations rather than code execution or data exposure. | Patch ESXi to ESXi-9.1.0.0-25370933 (9.1.x), ESXi-9.0.2.0100-25595025 (9.0.x) or ESXi80U3j-25429389 (8.0); for Cloud Foundation/vSphere Foundation follow Broadcom advisory 38017. Schedule the required reboot. | |
| CVE-2026-96198 | FYI | 51 | 17 | 90 | 80 | 8.8 | 48.0 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-29 | CISA SSVC: total technical impact | Update Microsoft Edge (Chromium-based) to version 154.0.4258.37 or later per the MSRC update guide. | ||
| CVE-2026-76025 | FYI | 51 | 17 | 90 | 80 | 8.8 | 15.4 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac). | |||
| CVE-2026-85897 | FYI | 51 | 17 | 90 | 80 | 8.8 | 48.0 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-29 | CISA SSVC: total technical impact | Update Microsoft Edge (Chromium-based) to version 154.0.4258.37 or later per the MSRC update guide. | ||
| CVE-2026-96196 | FYI | 50 | 22 | 90 | 65 | 8.8 | 55.5 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-29 | A security-feature bypass in Edge, ubiquitous on endpoints, with no privileges or authentication needed beyond user interaction; no exploitation, exploit code or detection template is recorded, so this is a patch-cadence item rather than an emergency. | Update Microsoft Edge (Chromium-based) to version 156.0.4314.50 or later via the MSRC update guide for CVE-2026-96196; expect a browser restart. Verify version compliance across managed endpoints. | ||
| CVE-2026-112816 | FYI | 49 | 36 | 58 | 65 | 10.0 | none | none | canonical | lxd | 2026-10-30 | CISA SSVC: automatable; CISA SSVC: total technical impact | Upgrade to LXD 4.0.15, 5.0.11, 5.21.9 or 6.10.1 or later, per the Canonical security advisory GHSA-99jp-jwmc-65p4. | |||
| CVE-2026-96192 | FYI | 48 | 17 | 78 | 80 | 8.8 | 47.9 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-29 | CISA SSVC: total technical impact | Update Microsoft Edge for iOS to version 155.0.4283.45 or later per the MSRC update guide. | ||
| CVE-2026-93680 | REVIEW | 48 | 45 | 38 | 65 | 9.8 | 83.0 | none | MSF:300 | weaponized_early | langflow, ibm | langflow oss | 2026-10-29 | Pre-authentication, no-user-interaction authentication bypass (CVSS 9.8) in Langflow OSS, with a Metasploit module already present. Exploitation is not yet confirmed by SSVC or KEV, but the barrier to weaponising this is low. | Upgrade Langflow OSS to 1.13.0 or later (pip install langflow –upgrade, or pull the latest tagged Docker image) and restart the service. Until upgraded, restrict the Langflow UI/API to trusted networks rather than exposing it to the internet. | |
| CVE-2026-119263 | FYI | 48 | 18 | 90 | 65 | 9.6 | 9.7 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac). | |||
| CVE-2026-119261 | FYI | 48 | 18 | 90 | 65 | 9.6 | 11.6 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac, 156.0.8078.79 on Linux). | |||
| CVE-2026-112651 | FYI | 48 | 17 | 78 | 80 | 8.8 | 45.2 | none | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | CISA SSVC: total technical impact | Fixed in Safari 27.2, iOS/iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, and visionOS 27.2; update to these versions or later. | ||
| CVE-2026-119268 | FYI | 47 | 17 | 90 | 65 | 8.8 | 9.7 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 for Windows and Mac, 156.0.8078.79 for Linux). | |||
| CVE-2026-96203 | FYI | 47 | 17 | 90 | 65 | 8.8 | 47.9 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-29 | CISA SSVC: total technical impact | Update Microsoft Edge (Chromium-based) to version 155.0.4283.45 or later, per the MSRC update guide for CVE-2026-96203. | ||
| CVE-2026-76031 | FYI | 47 | 17 | 90 | 65 | 8.8 | 15.5 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac, 156.0.8078.79 on Linux). | |||
| CVE-2026-76029 | FYI | 47 | 17 | 90 | 65 | 8.8 | 9.7 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac, 156.0.8078.79 on Linux). | |||
| CVE-2026-76030 | FYI | 47 | 17 | 90 | 65 | 8.8 | 9.7 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac). | |||
| CVE-2026-119267 | FYI | 47 | 17 | 90 | 65 | 8.8 | 9.7 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 for Windows and Mac, 156.0.8078.79 for Linux). | |||
| CVE-2026-119265 | FYI | 47 | 17 | 90 | 65 | 8.8 | 9.7 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac, 156.0.8078.79 on Linux). | |||
| CVE-2026-119271 | FYI | 47 | 17 | 90 | 65 | 8.8 | 9.7 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac). | |||
| CVE-2026-119270 | FYI | 47 | 17 | 90 | 65 | 8.8 | 11.6 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac, 156.0.8078.79 on Linux). | |||
| CVE-2026-119269 | FYI | 47 | 17 | 90 | 65 | 8.8 | 9.7 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac). | |||
| CVE-2026-76026 | FYI | 47 | 17 | 90 | 65 | 8.8 | 9.7 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac, 156.0.8078.79 on Linux). | |||
| CVE-2026-85890 | FYI | 47 | 17 | 90 | 65 | 8.8 | 48.0 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-29 | A double-free in Edge reachable over the network with no privileges, but it requires user interaction (a victim visiting a crafted page), and no exploitation, exploit code or detection template has been observed. | Update Microsoft Edge (Chromium-based) to 154.0.4258.37 or later via the MSRC update guide; confirm the browser build on managed endpoints and enforce auto-update so stragglers are caught. | ||
| CVE-2026-119260 | FYI | 47 | 17 | 90 | 65 | 8.8 | 9.7 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac). | |||
| CVE-2026-119262 | FYI | 47 | 17 | 90 | 65 | 8.8 | 14.7 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac). | |||
| CVE-2026-119266 | FYI | 47 | 17 | 90 | 65 | 8.8 | 9.7 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac, 156.0.8078.79 on Linux). | |||
| CVE-2026-96199 | FYI | 47 | 17 | 90 | 65 | 8.8 | 48.0 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-29 | CISA SSVC: total technical impact | Update Microsoft Edge (Chromium-based) to version 154.0.4258.37 or later, per the MSRC update guide for CVE-2026-96199. | ||
| CVE-2026-76028 | FYI | 47 | 17 | 90 | 65 | 8.8 | 9.7 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac). | |||
| CVE-2026-119264 | FYI | 47 | 17 | 90 | 65 | 8.8 | 9.7 | none | none | chrome | 2026-10-30 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac, 156.0.8078.79 on Linux). | |||
| CVE-2026-118333 | FYI | 44 | 10 | 90 | 65 | 9.3 | 9.2 | none | none | chrome | 2026-10-27 | no exploitation evidence in any monitored source | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-39738 | REVIEW | 44 | 31 | 33 | 80 | 9.8 | 35.1 | none | none | aman | funnelkit automations | 2026-10-30 | Unauthenticated PHP object injection in a widely deployed WordPress plugin, CVSS 9.8 with no user interaction, but no exploitation has been observed and EPSS sits at 0.004. | Update FunnelKit Automations to 3.8.6.2 or higher, then restart the service. If you cannot patch promptly, restrict access to wp-admin and plugin endpoints and monitor for anomalous requests. | ||
| CVE-2026-110799 | FYI | 44 | 48 | 13 | 65 | 9.8 | poc | poc_early | givanz | vvveb | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | Upgrade to Vvveb 1.0.8.7 or later; all versions prior to 1.0.8.7 are affected. | |||
| CVE-2026-118337 | FYI | 44 | 10 | 90 | 65 | 9.3 | 9.2 | none | none | chrome | 2026-10-27 | no exploitation evidence in any monitored source | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 for Windows and Mac, 156.0.8078.73 for Linux). | |||
| CVE-2026-107249 | FYI | 42 | 31 | 58 | 49 | 9.8 | 8.6 | none | none | drupal | block ajax | 2026-10-30 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-99170 | FYI | 41 | 0 | 90 | 73 | 8.8 | 5.5 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | Apply the upstream kernel patches bd71d33923b9 and 69fbe94f80bc; fixed in 7.2.13 and later and in 7.3 and later. | |||
| CVE-2026-85268 | FYI | 41 | 21 | 38 | 85 | 8.7 | none | none | google cloud | identity platform and firebase authentication | 2026-10-30 | CISA SSVC: total technical impact | Patched server-side for all users with no app updates required; developers who self-host the auth helper code (Option 4) must re-synchronize it from the Firebase redirect best practices documentation. | |||
| CVE-2026-104339 | REVIEW | 41 | 31 | 38 | 65 | 9.8 | 54.8 | none | none | langflow, ibm | langflow oss | 2026-10-29 | Unauthenticated remote OS command injection in Langflow OSS with a CVSS of 9.8 and a fixed version already published; no exploitation, public exploit code or detection template has been observed, so urgency rests on severity and exposure rather than active attacks. | Upgrade Langflow OSS to 1.12.4, following the vendor’s prepare-to-upgrade and release-specific configuration steps, then test flows afterward. Until upgraded, keep the Langflow instance off the public internet or behind a VPN/WAF and restrict who can reach it. | ||
| CVE-2026-103780 | REVIEW | 41 | 26 | 70 | 40 | 9.8 | 57.6 | none | none | dell | powerprotect data domain | 2026-10-28 | Unauthenticated remote stack buffer overflow in Dell PowerProtect Data Domain with a CVSS of 9.8 and a stated fix; no public exploit code, KEV listing or exploitation signal exists yet, and the appliance is typically not internet-exposed. | Upgrade to 8.9.0.0+ (Feature Release), 7.13.1.90+ (LTS2024), 8.3.1.50+ (LTS2025) or 8.6.1.30+ (LTS2026) per Dell DSA-2026-416; until then keep the Data Domain management interface off the internet and behind trusted networks only. | ||
| CVE-2026-99153 | FYI | 41 | 1 | 90 | 73 | 9.8 | 8.8 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | Apply the upstream kernel patch validating the reflected ITT in Reject PDUs; fixed in stable releases 5.10.273, 5.15.224 and 6.1.191 or later. | |||
| CVE-2026-99154 | FYI | 41 | 1 | 90 | 73 | 9.8 | 7.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | Apply the upstream kernel patch that bounds the task index from below in both libiscsi lookups; fixed in stable releases 5.10.273, 5.15.224 and 6.1.191 and later. | |||
| CVE-2026-86400 | REVIEW | 41 | 26 | 70 | 40 | 9.8 | 59.5 | none | none | dell | powerprotect data domain | 2026-10-28 | Unauthenticated remote attacker can gain root command execution on PowerProtect Data Domain appliances, which typically hold backup data and sit on the network. No exploitation has been observed and EPSS is low (0.009), so this is a patch-window item rather than an emergency. | Upgrade to 8.9.0.0+, 7.13.1.90+ (LTS2024), 8.3.1.50+ (LTS2025) or 8.6.1.30+ (LTS2026) per Dell DSA-2026-416. Until then, restrict appliance management access to trusted networks and monitor for anomalous admin activity. | ||
| CVE-2026-99131 | FYI | 41 | 0 | 90 | 73 | 8.2 | 8.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to a kernel release containing the fix: 6.1.191 or later, 6.6.161 or later, or 6.12.115 or later (the change replaces has_capability_noaudit() with ns_capable_noaudit()). | |||
| CVE-2026-110186 | REVIEW | 41 | 31 | 38 | 65 | 9.8 | 49.8 | none | none | langflow, ibm | langflow oss | 2026-10-29 | Unauthenticated remote code execution in Langflow OSS with a CVSS of 9.8 and a stated fix, but no exploitation has been observed and EPSS is only 0.006 (49th percentile). | Upgrade Langflow OSS to 1.13.0 or later (pip install langflow –upgrade, or pull the latest tagged Docker image) and restart the service. Until upgraded, keep the Langflow UI/API off the public internet and behind authentication. | ||
| CVE-2026-99185 | FYI | 41 | 0 | 90 | 73 | 8.8 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | Apply the upstream kernel fix commits a8caee0e623ca5d56e829032f9ec073c09e4d224 or 7f9f2d6abc40f79e802b4063859eda343043b85c; fixed in 7.2.13 and later, and 7.3 and later. | |||
| CVE-2026-107656 | REVIEW | 41 | 26 | 70 | 40 | 9.8 | 58.2 | none | none | fortinet | fortisandbox paas | 2026-10-26 | CISA SSVC: automatable; CISA SSVC: total technical impact; floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Upgrade to FortiSandbox 5.2.0 or above, 5.0.7 or above, or 4.4.10 or above; FortiSandbox PaaS to 5.0.7 or above. | ||
| CVE-2025-31704 | FYI | 40 | 36 | 38 | 49 | 9.8 | none | none | dahua | intelligent connection center | 2026-10-30 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-119706 | FYI | 40 | 48 | 13 | 50 | 9.8 | poc | poc_early | internlm | lmdeploy | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-64759 | FYI | 40 | 0 | 78 | 80 | 8.8 | 39.0 | none | none | apple | ios and ipados · macos | 2026-10-26 | CISA SSVC: total technical impact | Fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7. | ||
| CVE-2026-69446 | FYI | 39 | 0 | 90 | 65 | 4.4 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-30 | CISA SSVC: total technical impact | Update Microsoft Edge (Chromium-based) to version 152.0.4191.53 or later, per the MSRC update guide for CVE-2026-69446. | |||
| CVE-2026-119418 | FYI | 38 | 20 | 33 | 80 | 8.1 | none | none | cakephp | cakephp | 2026-10-30 | CISA SSVC: total technical impact | Apply the upstream patches referenced in CakePHP pull request #19735 (commits 18de3e4, a5ca174, 3c1183f); versions through 5.4.3 are affected. | |||
| CVE-2026-61739 | FYI | 38 | 35 | 18 | 65 | 7.5 | poc | poc_early | socfortress | copilot | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: automatable | Upgrade to CoPilot 0.1.77 or later, which adds the missing authorization checks and rejects invalid tokens. | |||
| CVE-2026-86397 | REVIEW | 38 | 21 | 70 | 40 | 9.8 | 27.1 | none | none | dell | powerprotect data domain | 2026-10-28 | Unauthenticated remote attacker can create a privileged account and take full control of a PowerProtect Data Domain appliance; CVSS 9.8 with no user interaction. EPSS is low (0.0034) and no exploitation signal exists yet, so this is a patch-ahead item rather than an incident. | Upgrade to 8.9.0.0+ (Feature Release), 7.13.1.90+ (LTS2024), 8.3.1.50+ (LTS2025) or 8.6.1.30+ (LTS2026) per Dell DSA-2026-416. Until then, keep the appliance’s management interface off the internet and restrict it to trusted admin networks. | ||
| CVE-2026-116386 | FYI | 38 | 36 | 13 | 65 | 9.8 | none | none | cozy vision technologies pvt. ltd. | sms alert order notifications | 2026-10-30 | CISA SSVC: automatable; CISA SSVC: total technical impact | Update the SMS Alert Order Notifications plugin to 4.0.3 or a higher version. | |||
| CVE-2026-78403 | FYI | 38 | 36 | 13 | 65 | 9.8 | none | none | thalesgroup | sentinel keys server | 2026-10-30 | CISA SSVC: automatable; CISA SSVC: total technical impact | Upgrade Sentinel Keys Server to version 1.3.8.0 or later; versions lower than 1.3.8.0 are affected. | |||
| CVE-2026-86384 | REVIEW | 38 | 21 | 70 | 40 | 9.8 | 40.8 | none | none | dell | powerprotect data domain | 2026-10-28 | Unauthenticated remote attackers can exploit hard-coded cryptographic keys in PowerProtect Data Domain to expose credentials and gain that user’s privileges; no exploitation is observed yet, but the attack is automatable and the impact total. | Upgrade to 8.9.0.0+, 7.13.1.90+ (LTS2024), 8.3.1.50+ (LTS2025) or 8.6.1.30+ (LTS2026) per Dell DSA-2026-416; until then restrict management access to trusted networks and rotate credentials that may have been exposed. | ||
| CVE-2023-22793 | FYI | 38 | 20 | 70 | 40 | 9.3 | 44.5 | none | none | veeam | management pack for microsoft system center | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-102649 | REVIEW | 38 | 35 | 18 | 65 | 9.9 | 39.7 | poc | poc_early | padok-team | burrito | 2026-10-26 | Unauthenticated, no-interaction forgery of webhook events lets anyone who can reach burrito-server trigger terraform plans using the operator’s stored git and cloud credentials. No public exploit code or active exploitation is confirmed; EPSS is 0.00458. | Upgrade to Burrito 0.13.0 or later, which fixes unsigned webhook acceptance. Until then, set a non-empty webhookSecret on every TerraformRepository credential and restrict burrito-server’s /api/webhook endpoint to GitHub/GitLab source ranges. | ||
| CVE-2026-99216 | FYI | 38 | 0 | 78 | 73 | 8.4 | 6.4 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | Apply the upstream kernel stable patches (e.g. commit 2732210132f92aca0622b5134027990a809279d5); fixed in 5.10.273, 5.15.224 and 6.1.191 and later. | |||
| CVE-2026-93328 | FYI | 38 | 35 | 18 | 65 | 9.3 | none | none | google cloud | mcp toolbox for databases (googleapis/mcp-toolbox) | 2026-10-26 | CISA SSVC: automatable; CISA SSVC: total technical impact | Upgrade googleapis/mcp-toolbox to version 1.5.0 or later, then set allowedLocalRoots and allowedBuckets to restrict file system and bucket access. | |||
| CVE-2026-118697 | FYI | 38 | 4 | 78 | 65 | 9.0 | none | none | jetbrains | toolbox app · intellij idea | 2026-10-30 | CISA SSVC: total technical impact | Upgrade Toolbox App to 3.9.1 or later (or 3.8.2 or later on the 3.8 line) and IntelliJ IDEA to 2026.3 or later (or 2026.2.4 or later on the 2026.2 line). | |||
| CVE-2026-61737 | FYI | 38 | 36 | 13 | 65 | 9.8 | none | none | huajian123 | ng-antd-admin | 2026-10-30 | CISA SSVC: automatable; CISA SSVC: total technical impact | Upgrade to ng-antd-admin 22.0 or later, which rejects the shipped JWT secret in production (non-production still permits it with a warning). | |||
| CVE-2026-116508 | FYI | 37 | 43 | 13 | 50 | 10.0 | 49.1 | poc | poc_early | totolink | a950rg | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-112438 | FYI | 37 | 12 | 70 | 55 | 8.8 | 54.3 | none | none | apple | macos | 2026-10-26 | CISA SSVC: total technical impact | Update to macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, or macOS Golden Gate 27.2 or later. | ||
| CVE-2026-118696 | FYI | 37 | 2 | 78 | 65 | 8.0 | none | none | jetbrains | intellij idea · pycharm · phpstorm +8 more | 2026-10-30 | CISA SSVC: total technical impact | Upgrade to the fixed build for your IDE: IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm 2026.3, 2026.2.4, 2026.1.5.1 or 2025.3.6.2; GoLand 2026.3, 2026.2.4, 2026.1.5.1 or 2025.3.5.2; Rider 2026.3, 2026.2.4, 2026 | |||
| CVE-2026-86929 | FYI | 37 | 12 | 70 | 55 | 8.8 | 51.3 | none | none | apple | macos | 2026-10-26 | CISA SSVC: total technical impact | Fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. | ||
| CVE-2026-73186 | FYI | 37 | 17 | 33 | 80 | 8.8 | none | none | shortpixel | enable media replace | 2026-10-30 | CISA SSVC: total technical impact | Update Enable Media Replace to version 4.2.3 or later. | |||
| CVE-2026-115924 | FYI | 36 | 32 | 13 | 65 | 8.6 | 33.5 | poc | poc_early | danielgatis | rembg | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | Upgrade rembg to version 2.0.82 or later, which fixes the sam_model path traversal and unpinned download issue. | ||
| CVE-2026-112427 | FYI | 36 | 10 | 70 | 55 | 8.1 | 52.7 | none | none | apple | macos | 2026-10-26 | CISA SSVC: total technical impact | Update to macOS Golden Gate 27.2 or later. | ||
| CVE-2026-119680 | FYI | 35 | 8 | 58 | 65 | 8.5 | none | manageengine | sharepoint manager plus | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade SharePoint Manager Plus to client application build 4508 or later. | ||||
| CVE-2026-118307 | FYI | 35 | 7 | 70 | 55 | 8.8 | 26.2 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Upgrade Google Chrome to version 156.0.8078.73 or later. | |||
| CVE-2026-118338 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.4 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118313 | FYI | 35 | 7 | 70 | 55 | 8.8 | 19.9 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.73 or later. | |||
| CVE-2026-118342 | FYI | 35 | 8 | 70 | 55 | 9.6 | 22.2 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.73 or later. | |||
| CVE-2026-118306 | FYI | 35 | 8 | 70 | 55 | 9.6 | 30.7 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.73 or later. | |||
| CVE-2026-118308 | FYI | 35 | 8 | 70 | 55 | 9.6 | 23.6 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Upgrade Google Chrome to version 156.0.8078.73 or later. | |||
| CVE-2026-118353 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.4 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118341 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.4 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118351 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.4 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118352 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.3 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Chrome to 156.0.8078.73 or later (156.0.8078.74 on Windows/Mac). | |||
| CVE-2026-104317 | REVIEW | 35 | 19 | 38 | 65 | 9.8 | 47.4 | none | none | langflow, ibm | langflow oss | 2026-10-29 | Unauthenticated deserialization of untrusted data in Langflow OSS 1.0.0-1.12.3, CVSS 9.8, but the attacker must first reach the message broker, which limits exposure to deployments with that component reachable. | Upgrade Langflow OSS to 1.12.4, following the documented prepare-to-upgrade steps and release-specific configuration changes. Until then, restrict network access to the message broker to trusted hosts only. | ||
| CVE-2026-118348 | FYI | 35 | 7 | 70 | 55 | 8.8 | 27.5 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118355 | FYI | 35 | 8 | 70 | 55 | 9.6 | 22.2 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.73 or later. | |||
| CVE-2026-118344 | FYI | 35 | 7 | 70 | 55 | 8.8 | 27.5 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118350 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.4 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118343 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.4 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 for Windows and Mac, 156.0.8078.73 for Linux). | |||
| CVE-2026-118305 | FYI | 35 | 8 | 70 | 55 | 9.6 | 30.7 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Upgrade Google Chrome to version 156.0.8078.73 or later. | |||
| CVE-2026-118317 | FYI | 35 | 7 | 70 | 55 | 8.8 | 24.6 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-18894 | REVIEW | 35 | 18 | 38 | 65 | 9.8 | 37.0 | none | none | langflow, ibm | langflow oss | 2026-10-29 | Pre-auth, no-interaction code execution in Langflow OSS public workflows, but exploitation is unconfirmed: no KEV listing, no public exploit, EPSS 0.004, and the product is niche. | Upgrade Langflow OSS to 1.12.5. For MCP stdio deployments also set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true, then restart the service. Until patched, restrict public workflow exposure to trusted users. | ||
| CVE-2026-118354 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.3 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-61992 | REVIEW | 35 | 31 | 13 | 65 | 9.8 | 32.7 | none | none | von eyal fitoussi | geo my wordpress | 2026-10-29 | Unauthenticated PHP object injection in a WordPress plugin, CVSS 9.8 with no user interaction, but no exploitation signal: EPSS 0.0039, no KEV, no public exploit or detection template. | Upgrade GEO my WordPress to 4.5.5.4 or later; versions up to and including 4.5.5.3 are affected. If the plugin is not in active use, remove it, and check the site for unexpected files or new admin accounts. | ||
| CVE-2026-93327 | FYI | 35 | 18 | 18 | 85 | 9.4 | none | none | google cloud | application integration | 2026-10-30 | CISA SSVC: total technical impact | Google patched this server-side on 11 September 2026; no customer action is required. | |||
| CVE-2026-118339 | FYI | 35 | 7 | 70 | 55 | 8.8 | 24.6 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-115915 | REVIEW | 35 | 14 | 25 | 85 | 9.8 | 51.6 | none | none | vllm, vllm-project | vllm | 2026-10-26 | Pre-auth, no-interaction flaw in vLLM’s image handling lets attacker-supplied bytes reach Pillow decoders, chaining to command execution where Ghostscript CVE-2024-29510 is present. No exploitation is observed and EPSS is low, but the impact is total where the dependency chain exists. | Upgrade vLLM to 0.32.0 or later, which restricts decoder selection for image media input. If you cannot upgrade promptly, disable image-capable request paths or restrict them to trusted clients, and confirm whether Ghostscript or Pillow 12.0.0-12.2.0 is present in the serving host. | ||
| CVE-2026-118347 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.4 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118304 | FYI | 35 | 7 | 70 | 55 | 8.8 | 19.9 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Upgrade Google Chrome to 156.0.8078.73 or later. | |||
| CVE-2026-118579 | FYI | 35 | 38 | 25 | 40 | 9.8 | 56.2 | poc | poc_early | d-link | dir-505 | 2026-10-28 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-118330 | FYI | 35 | 7 | 70 | 55 | 8.8 | 26.8 | none | none | google, microsoft | chrome · windows | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome on Windows to 156.0.8078.73 or later (156.0.8078.73/.74 stable channel release). | ||
| CVE-2026-31158 | FYI | 35 | 38 | 25 | 40 | 9.8 | 52.6 | poc | poc_early | n/a | n/a | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-118327 | FYI | 35 | 7 | 70 | 55 | 8.8 | 19.9 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118349 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.4 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118359 | FYI | 35 | 7 | 70 | 55 | 8.8 | 20.8 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-116099 | FYI | 35 | 23 | 25 | 70 | 8.8 | 31.8 | poc | poc_early | fcs-ex, fusion creators studio | scp containment breach multiplayer | 2026-10-26 | Pre-auth, no-user-interaction out-of-bounds write (CVSS 9.8) in a game’s Skynet++ VM, with published exploit code. EPSS is low at 0.00316 and the product is rare in enterprise estates, so exposure is likely minimal. | Upgrade SCP Containment Breach Multiplayer to 1.3R or later. If the game is not permitted on managed endpoints, confirm it is absent or remove it; where it must stay, restrict network exposure until the upgrade is applied. | ||
| CVE-2026-118336 | FYI | 35 | 7 | 70 | 55 | 8.8 | 24.6 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-115346 | FYI | 35 | 20 | 33 | 65 | 8.1 | none | none | themefusion | avada | website builder for wordpress & woocommerce | 2026-10-30 | CISA SSVC: total technical impact | Upgrade Avada to version 7.16.4 or later, per the vendor’s security update; versions up to and including 7.16.2 are affected. | |||
| CVE-2026-118332 | FYI | 35 | 8 | 70 | 55 | 9.6 | 22.2 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.73 or later; all earlier versions are affected. | |||
| CVE-2026-118358 | FYI | 35 | 7 | 70 | 55 | 8.8 | 29.5 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118328 | FYI | 35 | 7 | 70 | 55 | 8.8 | 34.4 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118340 | FYI | 35 | 8 | 70 | 55 | 9.6 | 29.1 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later. | |||
| CVE-2026-118329 | FYI | 35 | 7 | 70 | 55 | 8.8 | 32.9 | none | none | google, apple | chrome · macos | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome on Mac to 156.0.8078.73 or later (156.0.8078.73/.74 stable channel release). | ||
| CVE-2026-118331 | FYI | 35 | 7 | 70 | 55 | 8.8 | 27.5 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118334 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.4 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118356 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.3 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118316 | FYI | 35 | 8 | 70 | 55 | 9.6 | 22.2 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.73 or later. | |||
| CVE-2026-107092 | FYI | 35 | 38 | 25 | 40 | 9.8 | 63.9 | poc | poc_early | n/a | n/a | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-118321 | FYI | 35 | 8 | 70 | 55 | 9.6 | 29.1 | none | none | chrome · android | 2026-10-27 | CISA SSVC: total technical impact | Update Chrome on Android to 156.0.8078.73 or later, as shipped in the October 2026 Stable channel update. | |||
| CVE-2026-118314 | FYI | 35 | 7 | 70 | 55 | 8.8 | 19.9 | none | none | chrome · android | 2026-10-27 | CISA SSVC: total technical impact | Update Chrome on Android to 156.0.8078.73 or later (desktop builds 156.0.8078.73/.74 for Windows and Mac, 156.0.8078.73 for Linux). | |||
| CVE-2026-118335 | FYI | 35 | 7 | 70 | 55 | 8.8 | 15.6 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome on macOS to version 156.0.8078.73 or later. | |||
| CVE-2026-118346 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.4 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-62160 | FYI | 35 | 37 | 0 | 65 | 8.7 | poc | poc_early | daptin | daptin | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: automatable | Upgrade to Daptin 0.12.26 or later, which fixes the Accept-Language parsing issue. | |||
| CVE-2026-107239 | FYI | 35 | 17 | 58 | 49 | 8.8 | 51.0 | none | none | veeam | management pack for microsoft system center | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-118312 | FYI | 35 | 8 | 70 | 55 | 9.6 | 23.6 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Upgrade Google Chrome to version 156.0.8078.73 or later, per the Chrome stable channel release. | |||
| CVE-2026-118315 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.4 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118320 | FYI | 35 | 7 | 70 | 55 | 8.8 | 24.6 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118310 | FYI | 35 | 8 | 70 | 55 | 9.6 | 23.6 | none | none | google, microsoft | chrome · windows | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome on Windows to 156.0.8078.73 or later (stable channel release of October 27, 2026). | ||
| CVE-2026-118311 | FYI | 35 | 7 | 70 | 55 | 8.8 | 19.9 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to version 156.0.8078.73 or later; versions prior to 156.0.8078.73 are affected. | |||
| CVE-2026-59106 | FYI | 35 | 36 | 13 | 55 | 9.8 | none | none | wolfvision | cynap pure (next gen), cynap bridge · cynap pro, cynap core pro, cynap receiver, cynap pure, cynap pure mini, cynap pure pro · cynap videobar, firmware version +1 more | 2026-10-26 | CISA SSVC: automatable; CISA SSVC: total technical impact | Until an update is applied, restrict network access to WolfProt ports TCP 50915 and 50917 and web management interfaces TCP 80 and 443 to trusted hosts only; these services cannot be disabled. | |||
| CVE-2026-118309 | FYI | 35 | 8 | 70 | 55 | 9.6 | 23.6 | none | none | chrome · android | 2026-10-27 | CISA SSVC: total technical impact | Update Chrome on Android to 156.0.8078.73 or later (desktop builds 156.0.8078.73/.74 for Windows and Mac, 156.0.8078.73 for Linux). | |||
| CVE-2026-118357 | FYI | 35 | 7 | 70 | 55 | 8.8 | 20.8 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-118345 | FYI | 35 | 7 | 70 | 55 | 8.8 | 18.4 | none | none | chrome | 2026-10-27 | CISA SSVC: total technical impact | Update Google Chrome to 156.0.8078.73 or later (156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux). | |||
| CVE-2026-18199 | FYI | 35 | 9 | 58 | 65 | 8.8 | none | zohocorp | manageengine password manager pro · manageengine pam360 | 2026-11-02 | no exploitation evidence in any monitored source | Upgrade Password Manager Pro to 13236 or later, and PAM360 to 8601 or later. | ||||
| CVE-2026-116366 | FYI | 34 | 33 | 6 | 65 | 9.5 | none | none | clickhouse | clickhouse cloud | 2026-10-30 | CISA SSVC: total technical impact | Upgrade ClickHouse to 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable or 26.10.3.7-stable (or later); ClickHouse Cloud versions from 25.12.1.1713, 26.2.1.835, 26.4.1.2704, 26.6.1.2439 and 26.8.1.597. | |||
| CVE-2026-107327 | FYI | 34 | 17 | 38 | 65 | 8.8 | 51.7 | none | none | langflow, ibm | langflow oss | 2026-10-29 | CISA SSVC: total technical impact | Upgrade Langflow OSS to version 1.12.5; for MCP stdio deployments also set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restart the service. | ||
| CVE-2026-61620 | FYI | 34 | 26 | 13 | 70 | 9.8 | none | none | seancorfield | honeysql | 2026-10-30 | CISA SSVC: automatable; CISA SSVC: total technical impact | Upgrade HoneySQL to 2.7.1392 or later; input validation before constructing `keyword` or `symbol` entities is a workaround. | |||
| CVE-2026-101288 | FYI | 34 | 17 | 38 | 65 | 8.8 | 52.6 | none | none | langflow, ibm | langflow oss | 2026-10-29 | CISA SSVC: total technical impact | Upgrade Langflow OSS to version 1.12.4, following the Prepare to upgrade instructions and release-specific configuration changes. | ||
| CVE-2026-63190 | REVIEW | 34 | 32 | 33 | 40 | 9.4 | 45.7 | poc | poc_early | fearlessgeekmedia | fearlesscms | 2026-10-28 | Unauthenticated, no-interaction path traversal and admin login bypass in FearlessCMS, reachable over the internet on the default Docker/PHP dev-server deployment; public proof-of-concept exists but exploitation has not been confirmed and EPSS is low (0.005). | Upgrade to FearlessCMS 0.1.4 or later, which fixes the unauthenticated debug scripts and the /./admin/ login bypass. If you cannot upgrade immediately, remove or block the admin/debug_*.php, preview-handler.php and testdebug.php endpoints and do not run the PHP built-in dev server in production. | ||
| CVE-2026-65327 | FYI | 34 | 6 | 70 | 55 | 8.4 | 16.8 | none | none | apple | macos | 2026-10-26 | CISA SSVC: total technical impact | Update to macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, or macOS Golden Gate 27.2 or later. | ||
| CVE-2026-85898 | FYI | 34 | 12 | 70 | 40 | 8.8 | 55.4 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-27 | CISA SSVC: total technical impact | Update Microsoft Edge (Chromium-based) to version 154.0.4258.48 or later per the MSRC update guide. | ||
| CVE-2026-104324 | FYI | 34 | 17 | 38 | 65 | 8.8 | 51.1 | none | none | langflow, ibm | langflow oss | 2026-10-29 | CISA SSVC: total technical impact | Upgrade Langflow OSS to version 1.12.4, following the Prepare to upgrade instructions and release-specific configuration changes. | ||
| CVE-2026-107328 | FYI | 34 | 17 | 38 | 65 | 8.8 | 57.3 | none | none | langflow, ibm | langflow oss | 2026-10-29 | CISA SSVC: total technical impact | Upgrade Langflow OSS to version 1.12.5; for MCP stdio deployments also set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restart the service. | ||
| CVE-2026-107329 | FYI | 34 | 17 | 38 | 65 | 8.8 | 57.3 | none | none | langflow, ibm | langflow oss | 2026-10-29 | CISA SSVC: total technical impact | Upgrade Langflow OSS to version 1.12.5; for MCP stdio deployments also set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restart the service. | ||
| CVE-2026-88077 | FYI | 34 | 12 | 70 | 40 | 8.8 | 50.6 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-29 | CISA SSVC: total technical impact | Update Microsoft Edge (Chromium-based) to version 154.0.4258.62 or later, per the MSRC update guide. | ||
| CVE-2026-115912 | FYI | 34 | 7 | 25 | 95 | 8.8 | 43.5 | none | none | vllm, vllm-project | vllm | 2026-10-26 | CISA SSVC: total technical impact | Upgrade to vLLM 0.32.0 or later, which fixes the shared-memory multimodal caching deserialization flaw. | ||
| CVE-2026-119526 | FYI | 34 | 36 | 13 | 50 | 9.8 | none | none | themerex | royal event | 2026-10-30 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-65184 | FYI | 34 | 36 | 13 | 50 | 9.8 | none | none | vertiv | avocent acs8000 | 2026-10-26 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-110193 | FYI | 34 | 17 | 38 | 65 | 8.8 | 55.3 | none | none | langflow, ibm | langflow oss | 2026-10-29 | CISA SSVC: total technical impact | Upgrade Langflow OSS to 1.13.0 or later (pip install langflow –upgrade, or pull the latest tagged Docker image). | ||
| CVE-2026-107326 | FYI | 34 | 17 | 38 | 65 | 8.8 | 52.6 | none | none | langflow, ibm | langflow oss | 2026-10-29 | CISA SSVC: total technical impact | Upgrade Langflow OSS to version 1.12.5; for MCP stdio deployments also set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restart the service. | ||
| CVE-2026-104328 | FYI | 34 | 17 | 38 | 65 | 8.8 | 52.6 | none | none | langflow, ibm | langflow oss | 2026-10-29 | CISA SSVC: total technical impact | Upgrade Langflow OSS to version 1.12.4, following the Prepare to upgrade instructions and release-specific configuration changes, then test your flows. | ||
| CVE-2026-112484 | FYI | 34 | 5 | 70 | 55 | 7.8 | 11.3 | none | none | apple | macos | 2026-10-26 | CISA SSVC: total technical impact | Update to macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, or macOS Golden Gate 27.2 or later. | ||
| CVE-2026-61730 | FYI | 34 | 27 | 18 | 65 | 9.3 | none | none | socfortress | copilot | 2026-10-30 | CISA SSVC: automatable | Upgrade to CoPilot 0.1.77 or later, which releases credential isolation; a release fully remediating the report-disclosure component has not been established. | |||
| CVE-2026-110176 | FYI | 34 | 13 | 58 | 50 | 8.7 | none | drupal | file force download | 2026-10-31 | no exploitation evidence in any monitored source | No patched release is named; disable the File Force Download module, keep sensitive files out of temporary:// and contributed stream wrappers, or block anonymous requests carrying a download parameter at the web server o | ||||
| CVE-2026-90888 | FYI | 34 | 36 | 13 | 50 | 9.8 | none | none | leadsnap | leadsnap | 2026-10-30 | CISA SSVC: automatable; CISA SSVC: total technical impact | ||||
| CVE-2026-119977 | FYI | 34 | 12 | 45 | 65 | 8.1 | none | wordpress foundation | wordpress | 2026-10-31 | no exploitation evidence in any monitored source | Upgrade to WordPress 7.1.4 or later, which changes the upgrader code paths referenced in the advisory. | ||||
| CVE-2026-112688 | FYI | 34 | 12 | 70 | 40 | 8.8 | 50.2 | none | none | apple | ios and ipados · macos | 2026-10-26 | CISA SSVC: total technical impact | Fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. | ||
| CVE-2026-83831 | FYI | 34 | 12 | 70 | 40 | 8.8 | 55.5 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-27 | CISA SSVC: total technical impact | Update Microsoft Edge (Chromium-based) to version 154.0.4258.48 or later, per the MSRC update guide for CVE-2026-83831. | ||
| CVE-2026-62048 | FYI | 33 | 27 | 13 | 65 | 9.3 | none | none | liquid web / stellarwp | bookit | 2026-11-01 | CISA SSVC: automatable | Update the BookIt WordPress plugin to version 2.6.0.7 or later. | |||
| CVE-2026-95664 | FYI | 33 | 0 | 70 | 60 | 5.4 | 57.7 | none | apache, apache software foundation | apache camel | 2026-10-26 | no exploitation evidence in any monitored source | Upgrade to 4.23.0, or to 4.22.2 on the 4.22.x line or 4.18.5 on the 4.18.x line; 4.8.x-4.17.x and 4.19.x-4.21.x are end of life and must move to a supported release. | |||
| CVE-2026-116852 | FYI | 33 | 17 | 33 | 65 | 9.1 | none | none | marketing fire | widget options | 2026-10-30 | CISA SSVC: total technical impact | Update the Widget Options plugin to 4.2.6 or a higher version. | |||
| CVE-2026-84295 | FYI | 33 | 31 | 13 | 55 | 10.0 | 46.2 | none | none | progress software | ws_ftp server | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | No patch is stated; the vendor directs customers to contact Progress Software Technical Support for guidance on available mitigations. | ||
| CVE-2026-117571 | FYI | 33 | 17 | 33 | 65 | 8.8 | 6.8 | none | none | unknown | wp visitor statistics (real time traffic) | 2026-10-30 | CISA SSVC: total technical impact | Update the WP Visitor Statistics (Real Time Traffic) plugin to version 8.8 or later. | ||
| CVE-2026-39732 | FYI | 33 | 27 | 13 | 65 | 9.3 | none | none | ivijan-stefan stipic | transliterator | 2026-10-30 | CISA SSVC: automatable | Update the Transliterator plugin to 2.5.14 or a higher version. | |||
| CVE-2026-85899 | FYI | 33 | 10 | 70 | 40 | 8.1 | 50.7 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-29 | CISA SSVC: total technical impact | Update Microsoft Edge (Chromium-based) to version 155.0.4283.45 or later, per the MSRC update guide for CVE-2026-85899. | ||
| CVE-2026-110196 | FYI | 32 | 12 | 38 | 65 | 8.8 | 42.0 | none | none | langflow, ibm | langflow oss | 2026-10-29 | CISA SSVC: total technical impact | Upgrade Langflow OSS to version 1.12.5; for MCP stdio deployments also set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restart the service. | ||
| CVE-2026-111101 | FYI | 32 | 25 | 13 | 65 | 8.7 | none | none | mtrudel | bandit | 2026-10-26 | CISA SSVC: automatable | Upgrade bandit to 1.14.0 or later; the fix commit is 220b9dfd27f9a21305be2afc75cbe585ddc24e7a. | |||
| CVE-2026-115269 | FYI | 32 | 25 | 13 | 65 | 8.7 | none | none | mtrudel | bandit | 2026-10-26 | CISA SSVC: automatable | Upgrade bandit to 1.14.0 or later; the fix is in commit 220b9dfd27f9a21305be2afc75cbe585ddc24e7a. Disabling HTTP/2 (http_2_options: [enabled: false]) avoids the vulnerable path as a workaround. | |||
| CVE-2026-115608 | FYI | 32 | 8 | 33 | 80 | 8.5 | none | none | crocoblock | jetengine | 2026-10-26 | no exploitation evidence in any monitored source | Update the WordPress JetEngine plugin to version 3.9.0.1 or later. | |||
| CVE-2026-105489 | FYI | 32 | 9 | 70 | 40 | 9.9 | 41.1 | none | none | adobe | adobe campaign classic | 2026-10-27 | CISA SSVC: total technical impact | Upgrade to Adobe Campaign Classic 7.4.4 build 9403 or later; versions up to and including 7.4.4 build 9402 are affected (Adobe advisory APSB26-162). | ||
| CVE-2026-72753 | FYI | 32 | 24 | 13 | 65 | 8.2 | none | none | nlnet labs | routinator | 2026-10-26 | CISA SSVC: automatable | Upgrade to Routinator 0.15.3 or later, which fixes this issue. | |||
| CVE-2026-99105 | FYI | 32 | 0 | 78 | 50 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to Linux 6.18.59 or later, 7.2.13 or later, or 7.3 or later; the fix sets need_resched on the switched-in task when SCX_ENQ_LAST leaves it on the local DSQ. | ||||
| CVE-2026-65566 | FYI | 32 | 17 | 13 | 80 | 8.8 | none | none | meow apps | ai engine | 2026-10-30 | CISA SSVC: total technical impact | Update the WordPress AI Engine plugin to version 3.8.9 or later. | |||
| CVE-2026-97200 | FYI | 32 | 24 | 13 | 65 | 8.2 | none | none | benoitc | hackney | 2026-10-26 | CISA SSVC: automatable | Upgrade hackney to 4.9.0 or later (affected: 2.0.0-beta.1 before 4.9.0); the fix commit is 493e8bf. | |||
| CVE-2026-86379 | FYI | 32 | 8 | 70 | 40 | 7.2 | 86.6 | none | none | dell | powerprotect data domain management center | 2026-10-28 | CISA SSVC: total technical impact | Upgrade to 8.9.0.0 or later (Feature Release), 7.13.1.90 or later (LTS2024), 8.3.1.50 or later (LTS2025), or 8.6.1.30 or later (LTS2026) per Dell DSA-2026-416. | ||
| CVE-2026-103792 | FYI | 32 | 8 | 70 | 40 | 9.6 | 30.8 | none | none | dell | powerprotect data domain management center | 2026-10-28 | CISA SSVC: total technical impact | Update to 8.9.0.0 or later (Feature Release), 7.13.1.90 or later (LTS2024), 8.3.1.50 or later (LTS2025), or 8.6.1.30 or later (LTS2026) per Dell DSA-2026-416. | ||
| CVE-2026-106174 | FYI | 32 | 8 | 70 | 40 | 7.5 | 20.8 | none | none | fortinet | fortios | 2026-10-27 | CISA SSVC: automatable | Upgrade to FortiOS 8.0.1 or above, or to FortiOS 7.6.7 or above. | ||
| CVE-2026-110541 | FYI | 32 | 8 | 70 | 40 | 7.2 | 78.6 | none | none | dell | powerprotect data domain | 2026-10-28 | CISA SSVC: total technical impact | Upgrade to 8.9.0.0 or later (Feature Release), 7.13.1.90 or later (LTS2024), 8.3.1.50 or later (LTS2025), or 8.6.1.30 or later (LTS2026) per Dell DSA-2026-416. | ||
| CVE-2026-113436 | FYI | 32 | 25 | 13 | 65 | 8.7 | none | none | mtrudel | bandit | 2026-10-26 | CISA SSVC: automatable | Upgrade bandit to 1.14.0 or later; the fix is in commit 220b9dfd27f9a21305be2afc75cbe585ddc24e7a. | |||
| CVE-2026-78845 | FYI | 32 | 33 | 13 | 49 | 9.8 | 25.8 | poc | poc_early | n/a | n/a | 2026-10-27 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-114213 | FYI | 32 | 25 | 13 | 65 | 8.7 | none | none | mtrudel | bandit | 2026-10-26 | CISA SSVC: automatable | Upgrade bandit to 1.14.0 or later (affected: 1.11.0 before 1.14.0); the patch commit is 220b9dfd27f9a21305be2afc75cbe585ddc24e7a. | |||
| CVE-2026-48360 | FYI | 32 | 8 | 70 | 40 | 9.6 | 39.1 | none | none | adobe | adobe connect desktop app · adobe connect android mobile app | 2026-10-27 | CISA SSVC: total technical impact | Upgrade Adobe Connect Desktop App to 2026.9.61 (Win), 2026.10.66 (Mac Silicon) or 2026.10.170 (Mac Intel), and the Android app to 4.5 or later. | ||
| CVE-2026-116811 | FYI | 32 | 24 | 13 | 65 | 8.8 | 42.4 | poc | poc_early | openpanel-dev | openpanel | 2026-10-27 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | Upgrade to OpenPanel 3.0.0 or later; versions before 3.0.0 are affected. | ||
| CVE-2026-111103 | FYI | 32 | 24 | 13 | 65 | 8.2 | none | none | mtrudel | bandit | 2026-10-26 | CISA SSVC: automatable | Upgrade bandit to 1.14.0 or later (affected: 1.9.0 before 1.14.0); alternatively disable HTTP/2 with http_2_options: [enabled: false]. | |||
| CVE-2026-107032 | FYI | 32 | 31 | 25 | 40 | 9.1 | 42.7 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-107015 | FYI | 32 | 31 | 25 | 40 | 9.1 | 42.7 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-110309 | FYI | 32 | 12 | 38 | 65 | 8.8 | 46.8 | none | none | langflow, ibm | langflow oss | 2026-10-29 | CISA SSVC: total technical impact | Upgrade Langflow OSS to version 1.12.5; for MCP stdio deployments also set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restart the service. | ||
| CVE-2026-97854 | NOISE | 31 | 26 | 33 | 40 | 9.8 | 71.9 | none | none | yamaha corporation | nwr100 | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-107251 | NOISE | 31 | 7 | 70 | 40 | 6.5 | 4.6 | none | none | drupal | entity reference manager (merge entities) | 2026-10-30 | CISA SSVC: automatable | |||
| CVE-2026-104349 | NOISE | 31 | 4 | 75 | 40 | 7.3 | 4.7 | none | none | adobe | creative cloud desktop application | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-90717 | NOISE | 31 | 7 | 70 | 40 | 9.1 | 14.2 | none | none | dell | powerprotect data domain management center | 2026-10-28 | CISA SSVC: total technical impact | Upgrade to 8.9.0.0 or later (Feature Release), 7.13.1.90 or later (LTS2024), 8.3.1.50 or later (LTS2025), or 8.6.1.30 or later (LTS2026) per Dell DSA-2026-416. | ||
| CVE-2026-107238 | NOISE | 31 | 6 | 70 | 40 | 8.7 | 39.1 | none | none | veeam | management pack for microsoft system center | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-84496 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 40.0 | none | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-113943 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 38.6 | none | none | apple | macos 27.0, 27.0.1 | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112556 | NOISE | 31 | 0 | 70 | 55 | 4.8 | 31.3 | none | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-104354 | NOISE | 31 | 7 | 70 | 40 | 9.1 | 42.5 | none | none | adobe | adobe campaign classic | 2026-10-27 | CISA SSVC: total technical impact | Upgrade to Adobe Campaign Classic 7.4.4 build 9403 or later; versions up to and including 7.4.4 build 9402 are affected. | ||
| CVE-2026-118008 | NOISE | 31 | 7 | 70 | 40 | 8.8 | 28.6 | none | none | mozilla | firefox · thunderbird | 2026-10-27 | CISA SSVC: total technical impact | Update to Firefox 159 or Thunderbird 159 or later. | ||
| CVE-2026-112637 | NOISE | 31 | 7 | 70 | 40 | 8.8 | 45.7 | none | none | apple | safari · ios and ipados · macos +3 more | 2026-10-26 | Use-after-free in WebKit reachable by any user who loads a malicious web page, with no credentials needed; exploitation is not observed and no public exploit or detection template exists, so this is a broad-exposure patching task rather than an emergency. | Update Safari, iOS/iPadOS, macOS Golden Gate, tvOS, visionOS and watchOS to 27.2 or later; prioritise Safari and iOS/iPadOS on devices used for browsing untrusted content, and note the update requires a restart. | ||
| CVE-2026-112659 | NOISE | 31 | 7 | 70 | 40 | 8.8 | 46.3 | none | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | CISA SSVC: total technical impact | Fixed in Safari 27.2, iOS/iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, and visionOS 27.2. | ||
| CVE-2026-96389 | NOISE | 31 | 7 | 70 | 40 | 6.5 | 2.8 | none | none | drupal | xray audit | 2026-10-30 | CISA SSVC: automatable | |||
| CVE-2026-112655 | NOISE | 31 | 7 | 70 | 40 | 8.8 | 48.3 | none | none | apple | safari · ios and ipados · macos +3 more | 2026-10-26 | CISA SSVC: total technical impact | Update to Safari 27.2, iOS/iPadOS 26.7.2 or 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2 or watchOS 27.2. | ||
| CVE-2026-118539 | NOISE | 31 | 7 | 70 | 40 | 6.5 | 12.8 | none | none | drupal | commerce core | 2026-10-30 | CISA SSVC: automatable | |||
| CVE-2026-91913 | NOISE | 31 | 17 | 58 | 30 | 8.8 | none | none | dell | openmanage enterprise | 2026-10-30 | CISA SSVC: total technical impact | Upgrade Dell OpenManage Enterprise to version 4.8.0 or later, per Dell advisory DSA-2026-467. | |||
| CVE-2026-55598 | NOISE | 31 | 21 | 18 | 65 | 9.1 | poc | poc_early | madeofpendletonwool | pinepods | 2026-10-30 | CISA SSVC: public proof of concept | Upgrade to PinePods 0.9.0 or later, which adds destination host/IP validation for feed enclosure URLs. | |||
| CVE-2026-86378 | NOISE | 31 | 7 | 70 | 40 | 8.8 | 30.6 | none | none | dell | powerprotect data domain | 2026-10-28 | CISA SSVC: total technical impact | Upgrade to 8.9.0.0 or later (Feature Release), 7.13.1.90 or later (LTS2024), 8.3.1.50 or later (LTS2025), or 8.6.1.30 or later (LTS2026); see Dell DSA-2026-416. | ||
| CVE-2026-112457 | NOISE | 31 | 0 | 70 | 55 | 7.1 | 28.9 | none | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112471 | NOISE | 31 | 0 | 70 | 55 | 4.3 | 41.5 | none | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-61572 | NOISE | 31 | 22 | 30 | 50 | 8.6 | 16.9 | poc | poc_early | wwbn | avideo-encoder | 2026-10-28 | CISA SSVC: public proof of concept; CISA SSVC: automatable | Upgrade to AVideo-Encoder 8.1.0 or later; note that 8.1.0 is only an initial remediation attempt and leaves private-network and TLS-verification variants unresolved. | ||
| CVE-2026-90730 | NOISE | 31 | 7 | 70 | 40 | 6.5 | 10.2 | none | none | dell | powerprotect data domain | 2026-10-27 | CISA SSVC: automatable | Upgrade to 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later, or 8.6.1.30 or later, per Dell DSA-2026-416 (KB 000515178). | ||
| CVE-2026-106076 | NOISE | 31 | 0 | 75 | 50 | 9.0 | 30.5 | none | veeam | backup for microsoft 365 | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-104353 | NOISE | 31 | 6 | 70 | 40 | 9.9 | 70.4 | none | adobe | adobe campaign classic | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to Adobe Campaign Classic 7.4.4 build 9403 or later; versions up to and including 7.4.4 build 9402 are affected (Adobe advisory APSB26-162). | |||
| CVE-2026-110245 | NOISE | 31 | 10 | 38 | 65 | 7.5 | 30.3 | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.5; for MCP stdio deployments also set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restart the service. | |||
| CVE-2026-85330 | NOISE | 31 | 0 | 70 | 55 | 4.3 | 29.6 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119209 | NOISE | 31 | 7 | 25 | 85 | 5.5 | 24.9 | none | none | pypdf_project, py-pdf | pypdf | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-112544 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 31.7 | none | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116504 | NOISE | 31 | 26 | 30 | 40 | 9.9 | 75.0 | poc | poc_early | totolink | a950rg | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-107262 | NOISE | 31 | 7 | 70 | 40 | 5.3 | 1.0 | none | none | drupal | advanced filesystem | 2026-10-30 | CISA SSVC: automatable | |||
| CVE-2026-107267 | NOISE | 31 | 7 | 70 | 40 | 5.3 | 3.5 | none | none | drupal | dkan | 2026-10-30 | CISA SSVC: automatable | |||
| CVE-2026-119682 | NOISE | 31 | 2 | 70 | 50 | 7.9 | none | manageengine | sharepoint manager plus | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86385 | NOISE | 31 | 7 | 70 | 40 | 8.8 | 31.0 | none | none | dell | powerprotect data domain | 2026-10-28 | CISA SSVC: total technical impact | Upgrade to PowerProtect Data Domain 8.9.0.0 or later, per Dell advisory DSA-2026-416 (KB 000515178). | ||
| CVE-2026-112623 | NOISE | 31 | 7 | 70 | 40 | 8.8 | 45.4 | none | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | CISA SSVC: total technical impact | Fixed in Safari 27.2, iOS/iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, and visionOS 27.2; update to these versions or later. | ||
| CVE-2026-120135 | NOISE | 31 | 12 | 33 | 65 | 8.2 | none | apache software foundation | apache thrift | 2026-10-31 | no exploitation evidence in any monitored source | Upgrade Apache Thrift (org.apache.thrift:libthrift) to version 0.24.0 or later; all versions before 0.24.0 are affected. | ||||
| CVE-2026-111505 | NOISE | 31 | 17 | 58 | 30 | 8.8 | none | none | dell | openmanage enterprise | 2026-10-30 | CISA SSVC: total technical impact | Upgrade Dell OpenManage Enterprise to version 4.8.0 or later, per Dell advisory DSA-2026-467. | |||
| CVE-2026-86987 | NOISE | 31 | 0 | 70 | 55 | 5.5 | 2.8 | none | none | apple | iphone_os · ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-118322 | NOISE | 31 | 0 | 70 | 55 | 4.3 | 10.5 | none | none | chrome | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76027 | NOISE | 31 | 0 | 70 | 55 | 4.3 | 9.4 | none | none | chrome | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-86396 | NOISE | 31 | 17 | 58 | 30 | 8.8 | 82.2 | none | none | dell | powerprotect data domain | 2026-10-28 | CISA SSVC: total technical impact | Upgrade to 8.9.0.0 or later (Feature Release), 7.13.1.90 or later (LTS2024), 8.3.1.50 or later (LTS2025), or 8.6.1.30 or later (LTS2026); see Dell DSA-2026-416. | ||
| CVE-2026-76024 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 7.5 | none | none | chrome | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119597 | NOISE | 31 | 16 | 13 | 80 | 9.8 | none | aidotnet | opendeepwiki | 2026-10-30 | no exploitation evidence in any monitored source | Apply the upstream patch commit 1bf0f4b5ef8d972ca640e5df145b5813a9492544 (see issue #403); no fixed release version is named. | ||||
| CVE-2026-86398 | NOISE | 31 | 7 | 70 | 40 | 8.8 | 28.0 | none | none | dell | powerprotect data domain | 2026-10-28 | CISA SSVC: total technical impact | Upgrade to 8.9.0.0 or later (feature release), 7.13.1.90 or later (LTS2024), 8.3.1.50 or later (LTS2025), or 8.6.1.30 or later (LTS2026); see Dell DSA-2026-416. | ||
| CVE-2026-92665 | NOISE | 31 | 7 | 70 | 40 | 5.3 | 35.8 | none | none | dell | powerprotect data domain | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-119272 | NOISE | 31 | 0 | 70 | 55 | 4.3 | 5.3 | none | none | chrome | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112708 | NOISE | 31 | 0 | 70 | 55 | 5.3 | 5.3 | none | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-113939 | NOISE | 31 | 0 | 70 | 55 | 6.5 | 38.6 | none | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112626 | NOISE | 31 | 7 | 70 | 40 | 8.8 | 47.5 | none | none | apple | safari · ios and ipados · macos +3 more | 2026-10-26 | CISA SSVC: total technical impact | Fixed in Safari 27.2, iOS/iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2 and watchOS 27.2. | ||
| CVE-2026-103779 | NOISE | 31 | 6 | 70 | 40 | 8.3 | 40.5 | none | none | dell | powerprotect data domain | 2026-10-28 | CISA SSVC: total technical impact | Upgrade to 8.9.0.0 or later (Feature Release), 7.13.1.90 or later (LTS2024), 8.3.1.50 or later (LTS2025), or 8.6.1.30 or later (LTS2026); see Dell DSA-2026-416. | ||
| CVE-2026-116275 | NOISE | 31 | 24 | 25 | 50 | 6.3 | poc | poc_early | allenai | allennlp | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-107257 | NOISE | 31 | 7 | 70 | 40 | 6.5 | 3.5 | none | none | drupal | actstream | 2026-10-30 | CISA SSVC: automatable | |||
| CVE-2026-118319 | NOISE | 31 | 0 | 70 | 55 | 4.3 | 6.8 | none | none | chrome | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118318 | NOISE | 31 | 0 | 70 | 55 | 4.3 | 9.6 | none | none | chrome | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99141 | NOISE | 30 | 0 | 78 | 40 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99198 | NOISE | 30 | 0 | 70 | 50 | 7.3 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99211 | NOISE | 30 | 0 | 70 | 50 | 5.2 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99193 | NOISE | 30 | 0 | 70 | 50 | 3.8 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-62765 | NOISE | 30 | 4 | 70 | 40 | 7.5 | 38.1 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-114148 | NOISE | 30 | 5 | 70 | 40 | 7.8 | 29.2 | none | none | microsoft | .net 10.0 installed on linux · .net 10.0 installed on mac os · .net 10.0 installed on windows +11 more | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-119545 | NOISE | 30 | 24 | 30 | 40 | 5.3 | poc | poc_early | forgejo | forgejo | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-99091 | NOISE | 30 | 0 | 70 | 50 | 5.6 | none | linux | linux | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99205 | NOISE | 30 | 0 | 78 | 40 | 3.8 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112677 | NOISE | 30 | 5 | 70 | 40 | 7.8 | 17.7 | none | none | apple | macos | 2026-10-26 | CISA SSVC: total technical impact | Update to macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, or macOS Golden Gate 27.2 or later. | ||
| CVE-2026-99144 | NOISE | 30 | 0 | 70 | 50 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86916 | NOISE | 30 | 5 | 70 | 40 | 7.8 | 10.2 | none | none | apple | ios and ipados · macos | 2026-10-26 | CISA SSVC: total technical impact | Update to iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7.2, or macOS Golden Gate 27. | ||
| CVE-2026-99096 | NOISE | 30 | 0 | 70 | 50 | none | linux | linux | 2026-10-26 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-99095 | NOISE | 30 | 0 | 70 | 50 | 5.6 | none | linux | linux | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99199 | NOISE | 30 | 0 | 70 | 50 | 3.8 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99195 | NOISE | 30 | 0 | 70 | 50 | 3.8 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116214 | NOISE | 30 | 14 | 13 | 80 | 9.1 | none | maccmspro, magicblack | maccms10 | 2026-10-26 | no exploitation evidence in any monitored source | Upgrade to MacCMS 2026.1000.4054 or later; the fix is in commit 27bb1b004b9931c93f46b65e9c0e531466e7e02a. | ||||
| CVE-2026-119654 | NOISE | 30 | 29 | 13 | 50 | 8.8 | poc | poc_early | devlive-community | datacap | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | ||||
| CVE-2026-62302 | NOISE | 30 | 25 | 5 | 65 | 8.7 | none | none | franklioxygen | mytube | 2026-10-30 | CISA SSVC: automatable | Upgrade to MyTube 1.10.3 or later, which mounts the authentication middleware before the static and cloud routes. | |||
| CVE-2026-99117 | NOISE | 30 | 0 | 70 | 50 | 7.8 | 7.3 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99200 | NOISE | 30 | 0 | 70 | 50 | 3.8 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119578 | NOISE | 30 | 22 | 25 | 50 | 7.8 | poc | poc_early | project-monai | monai | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | ||||
| CVE-2026-99207 | NOISE | 30 | 0 | 70 | 50 | 3.8 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99194 | NOISE | 30 | 0 | 70 | 50 | 3.8 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99172 | NOISE | 30 | 0 | 70 | 50 | 5.3 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99092 | NOISE | 30 | 0 | 70 | 50 | none | linux | linux | 2026-10-26 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-103093 | NOISE | 30 | 13 | 33 | 60 | 9.4 | 37.2 | none | none | servicenow | servicenow ai platform | 2026-10-29 | CISA SSVC: total technical impact | Apply the patched releases: Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3b, Zurich Patch 12, Zurich Patch 13, or Australia Patch 5 (per ServiceNow KB3228994). | ||
| CVE-2026-110244 | NOISE | 30 | 8 | 38 | 65 | 6.5 | 49.5 | none | none | langflow, ibm | langflow oss | 2026-10-29 | CISA SSVC: total technical impact | Upgrade Langflow OSS to version 1.12.5; for MCP stdio deployments also set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restart the service. | ||
| CVE-2026-99176 | NOISE | 30 | 0 | 70 | 50 | 8.8 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99089 | NOISE | 30 | 0 | 70 | 50 | 5.6 | none | linux | linux | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87103 | NOISE | 30 | 4 | 70 | 40 | 7.4 | 13.1 | none | none | acronis | acronis cyber protect 17 | 2026-10-28 | CISA SSVC: total technical impact | Upgrade Acronis Cyber Protect 17 to build 42587 or later. | ||
| CVE-2026-99140 | NOISE | 30 | 0 | 78 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2025-30414 | NOISE | 30 | 3 | 75 | 40 | 7.1 | 11.5 | none | none | acronis | acronis cyber protect cloud agent · acronis cyber protect 17 | 2026-10-28 | CISA SSVC: total technical impact | Upgrade Acronis Cyber Protect Cloud Agent (Windows) to build 42569 or later, and Acronis Cyber Protect 17 (Windows) to build 42587 or later. | ||
| CVE-2026-99208 | NOISE | 30 | 0 | 70 | 50 | 4.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99161 | NOISE | 30 | 0 | 78 | 40 | 7.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99165 | NOISE | 30 | 0 | 70 | 50 | 6.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99166 | NOISE | 30 | 0 | 78 | 40 | 6.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119187 | NOISE | 30 | 0 | 25 | 95 | 7.5 | 35.4 | none | digitalbazaar | forge | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99178 | NOISE | 30 | 0 | 70 | 50 | 6.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99196 | NOISE | 30 | 0 | 70 | 50 | 7.3 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99213 | NOISE | 30 | 0 | 70 | 50 | 7.8 | 6.4 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99197 | NOISE | 30 | 0 | 70 | 50 | 3.8 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-108140 | NOISE | 30 | 0 | 78 | 40 | 5.9 | 29.4 | none | veeam | backup and replication | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99209 | NOISE | 30 | 0 | 78 | 40 | 4.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-108141 | NOISE | 30 | 0 | 78 | 40 | 5.9 | 29.4 | none | veeam | backup and replication | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2025-11969 | NOISE | 30 | 10 | 21 | 80 | 9.4 | none | wso2 | wso2 api manager · wso2 identity server as key manager · wso2 open banking am +6 more | 2026-11-02 | no exploitation evidence in any monitored source | Apply the WSO2-2025-4733 security advisory fixes: API Manager 3.1.0.347, 3.2.0.450, 3.2.1.70 or 4.0.0.370 and later; Identity Server as Key Manager 5.10.0.367; Open Banking AM 2.0.0.396. | ||||
| CVE-2026-119191 | NOISE | 30 | 0 | 25 | 95 | 7.5 | 36.8 | none | digitalbazaar | forge | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-48379 | NOISE | 30 | 5 | 70 | 40 | 7.8 | 8.4 | none | none | adobe | adobe substance 3d painter | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-87102 | NOISE | 30 | 4 | 70 | 40 | 7.4 | 13.1 | none | none | acronis | acronis cyber protect 17 | 2026-10-28 | CISA SSVC: total technical impact | Upgrade Acronis Cyber Protect 17 (Linux, Windows) to build 42587 or later. | ||
| CVE-2026-99169 | NOISE | 30 | 0 | 70 | 50 | 6.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99171 | NOISE | 30 | 0 | 78 | 40 | 6.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99191 | NOISE | 30 | 0 | 78 | 40 | 6.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113957 | NOISE | 30 | 0 | 70 | 50 | 3.0 | none | apple | containerization | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-59158 | NOISE | 30 | 20 | 30 | 50 | 7.5 | 43.0 | poc | poc_early | thoda-dev | nuxt-ollama | 2026-10-27 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-99214 | NOISE | 30 | 0 | 70 | 50 | 4.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99130 | NOISE | 30 | 0 | 70 | 50 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99104 | NOISE | 30 | 0 | 70 | 50 | 6.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120283 | NOISE | 29 | 16 | 33 | 50 | 10.0 | none | linksys | e8450 | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86389 | NOISE | 29 | 3 | 70 | 40 | 7.2 | 45.1 | none | none | dell | powerprotect data domain | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-107253 | NOISE | 29 | 3 | 70 | 40 | 5.9 | 3.3 | none | none | drupal | orphans media | 2026-10-30 | CISA SSVC: total technical impact | |||
| CVE-2026-86394 | NOISE | 29 | 13 | 58 | 30 | 7.2 | 82.4 | none | none | dell | powerprotect data domain | 2026-10-28 | CISA SSVC: total technical impact | Upgrade to 8.9.0.0 or later (Feature Release), 7.13.1.90 or later (LTS2024), 8.3.1.50 or later (LTS2025), or 8.6.1.30 or later (LTS2026); see Dell DSA-2026-416. | ||
| CVE-2026-119419 | NOISE | 29 | 2 | 33 | 80 | 8.1 | none | cakephp | cakephp | 2026-10-30 | no exploitation evidence in any monitored source | Apply the upstream CakePHP patches referenced in PR #19726 (commits ae8c354, 21951fa, d04d342, ac07372); versions through 5.4.3 are affected. | ||||
| CVE-2026-101214 | NOISE | 29 | 13 | 58 | 30 | 7.2 | none | none | dell | openmanage enterprise | 2026-10-30 | CISA SSVC: total technical impact | Upgrade to Dell OpenManage Enterprise 4.8.0 or later, per Dell advisory DSA-2026-467. | |||
| CVE-2026-116257 | NOISE | 29 | 25 | 25 | 40 | 7.3 | 50.0 | poc | poc_early | n/a | billabear | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-94347 | NOISE | 29 | 3 | 70 | 40 | 7.2 | 22.1 | none | none | dell | powerprotect data domain virtual edition | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-61991 | NOISE | 29 | 26 | 25 | 40 | 10.0 | 54.8 | none | none | ajax load more | ajaxloadmore cache | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-116256 | NOISE | 29 | 25 | 25 | 40 | 7.3 | poc | poc_early | geesondog | rhaphp | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-115948 | NOISE | 29 | 8 | 33 | 65 | 8.5 | none | none | david lingren | media library assistant | 2026-10-26 | no exploitation evidence in any monitored source | Update the Media Library Assistant plugin to version 3.43 or later. | |||
| CVE-2026-111841 | NOISE | 29 | 12 | 13 | 80 | 8.8 | 2.6 | none | none | aman | funnelkit automations | 2026-10-26 | CISA SSVC: total technical impact | Update the FunnelKit Automations WordPress plugin to version 3.8.6 or later. | ||
| CVE-2026-86395 | NOISE | 29 | 13 | 58 | 30 | 7.2 | 82.4 | none | none | dell | powerprotect data domain virtual edition | 2026-10-28 | CISA SSVC: total technical impact | Upgrade to 8.9.0.0 or later (Feature Release), 7.13.1.90 or later (LTS2024), 8.3.1.50 or later (LTS2025), or 8.6.1.30 or later (LTS2026) per Dell DSA-2026-416. | ||
| CVE-2026-90728 | NOISE | 29 | 3 | 70 | 40 | 6.3 | 0.7 | none | none | dell | powerprotect data domain | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-88090 | NOISE | 29 | 3 | 70 | 40 | 5.4 | 24.7 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-29 | CISA SSVC: total technical impact | Update Microsoft Edge (Chromium-based) to version 154.0.4258.37 or later, per the MSRC update guide for CVE-2026-88090. | ||
| CVE-2026-86380 | NOISE | 29 | 3 | 70 | 40 | 7.2 | 40.0 | none | none | dell | powerprotect data domain | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-59978 | NOISE | 29 | 25 | 25 | 40 | 7.5 | poc | poc_early | adminneo-org | adminneo | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-62284 | NOISE | 29 | 11 | 13 | 80 | 8.6 | none | none | osac-project | osac-operator | 2026-10-30 | CISA SSVC: total technical impact | Upgrade to a build containing commit 7e4222b, which patches the credential-plugin execution path; note that this patch does not address the server-address SSRF path. | |||
| CVE-2026-90720 | NOISE | 29 | 3 | 70 | 40 | 6.7 | 0.2 | none | none | dell | powerprotect data domain | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-86393 | NOISE | 29 | 3 | 70 | 40 | 7.2 | 26.8 | none | none | dell | powerprotect data domain | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-118690 | REVIEW | 29 | 26 | 25 | 40 | 9.8 | 52.7 | none | none | signalk | signalk-server | 2026-10-28 | Unauthenticated internet-facing endpoint leaks log archives containing the JWT secret, letting an attacker forge admin tokens and persist. No exploitation is confirmed yet and EPSS is low, but the pre-auth path to full control is direct. | Upgrade Signal K Server to 2.33.0 or later, which fixes the unauthenticated /skServer/ziplogs endpoint, then restart the service. Until patched, restrict /skServer/ziplogs to trusted networks and rotate the JWT secretKey in security.json. | ||
| CVE-2026-94346 | NOISE | 29 | 3 | 70 | 40 | 7.2 | 44.9 | none | none | dell | powerprotect data domain virtual edition | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-116641 | NOISE | 29 | 3 | 70 | 40 | 6.8 | 3.7 | none | none | mongodb | database tools | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-115707 | NOISE | 29 | 3 | 63 | 45 | 6.4 | 2.2 | none | none | elastic | elastic_cloud_enterprise · elastic cloud enterprise | 2026-10-29 | CISA SSVC: total technical impact | Upgrade to ECE 3.8.6 or 4.2.1 (or later), then run the certificate rotation cleanup command from a host with the director role to remove retained rotation data. | ||
| CVE-2026-116232 | NOISE | 29 | 26 | 13 | 50 | 9.9 | 37.6 | poc | poc_early | oray | pugongying x5 pro | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-90729 | NOISE | 29 | 3 | 70 | 40 | 6.7 | 12.0 | none | none | dell | powerprotect data domain | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-61569 | NOISE | 29 | 20 | 25 | 50 | 7.5 | 20.8 | poc | poc_early | wwbn | avideo-encoder | 2026-10-28 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-86399 | NOISE | 29 | 13 | 58 | 30 | 7.2 | 82.4 | none | none | dell | powerprotect data domain | 2026-10-28 | CISA SSVC: total technical impact | Upgrade to 8.9.0.0 or later (Feature Release), 7.13.1.90 or later (LTS2024), 8.3.1.50 or later (LTS2025), or 8.6.1.30 or later (LTS2026); see Dell DSA-2026-416. | ||
| CVE-2026-110972 | NOISE | 29 | 11 | 13 | 80 | 8.6 | none | none | zakład ubezpieczeń społecznych | płatnik | 2026-10-30 | CISA SSVC: total technical impact | Fixed in Płatnik version 10.02.002 (metric 242); update to 10.02.002 or later. | |||
| CVE-2026-116339 | NOISE | 29 | 25 | 25 | 40 | 7.3 | poc | poc_early | iflytek | astron-agent | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-101210 | NOISE | 29 | 13 | 58 | 30 | 7.2 | none | none | dell | openmanage enterprise | 2026-10-30 | CISA SSVC: total technical impact | Upgrade to Dell OpenManage Enterprise 4.8.0 or later, per Dell advisory DSA-2026-467. | |||
| CVE-2026-87880 | NOISE | 29 | 3 | 70 | 40 | 6.8 | 1.7 | none | none | acronis | acronis cyber protect 17 | 2026-10-28 | CISA SSVC: total technical impact | Upgrade Acronis Cyber Protect 17 (Linux, Windows) to build 42587 or later. | ||
| CVE-2026-107049 | NOISE | 29 | 20 | 25 | 50 | 7.5 | 5.9 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2010-20125 | NOISE | 29 | 25 | 25 | 40 | 7.5 | poc | poc_early | dedecms | dedecms | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-119283 | NOISE | 29 | 20 | 25 | 50 | 7.5 | 13.7 | poc | poc_early | authlib | joserfc | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2025-64394 | NOISE | 29 | 0 | 75 | 40 | 4.3 | 1.1 | none | veeam | backup for microsoft 365 | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-103688 | REVIEW | 29 | 21 | 25 | 50 | 9.8 | 49.3 | none | none | unknown | checkout files upload for woocommerce | 2026-10-28 | CISA SSVC: automatable; CISA SSVC: total technical impact; floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Update the Checkout Files Upload for WooCommerce plugin to version 2.4.0 or later. | ||
| CVE-2026-106077 | NOISE | 29 | 0 | 75 | 40 | 8.3 | 13.7 | none | veeam | backup for microsoft 365 | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107250 | NOISE | 29 | 3 | 70 | 40 | 5.9 | 3.3 | none | none | drupal | eca helper | 2026-10-30 | CISA SSVC: total technical impact | |||
| CVE-2026-10757 | REVIEW | 29 | 21 | 25 | 50 | 9.8 | 38.7 | none | none | esri | arcgis server | 2026-10-26 | Pre-authentication SQL injection in internet-facing ArcGIS Server with CVSS 9.8, but no exploitation has been observed and EPSS sits at 0.4% – the risk is real for exposed instances, not yet an active campaign. | Apply the Esri patch for ArcGIS Server (12.1, 12.0, 11.5, 11.3, 11.1); upgrade first if on an unlisted version. Until patched, confirm services are not configured with public/anonymous access and restrict the endpoint to trusted networks. | ||
| CVE-2026-111504 | NOISE | 29 | 13 | 58 | 30 | 7.2 | none | none | dell | openmanage enterprise | 2026-10-30 | CISA SSVC: total technical impact | Upgrade to Dell OpenManage Enterprise 4.8.0 or later, per Dell advisory DSA-2026-467. | |||
| CVE-2026-87878 | NOISE | 29 | 3 | 70 | 40 | 6.3 | 3.5 | none | none | acronis | acronis cyber protect 17 | 2026-10-28 | CISA SSVC: total technical impact | Upgrade Acronis Cyber Protect 17 (Linux) to build 42587 or later. | ||
| CVE-2026-81472 | NOISE | 29 | 3 | 70 | 40 | 4.2 | 5.8 | none | none | dell | idrac service module for windows · idrac service module for linux · idrac service module for esxi | 2026-10-28 | CISA SSVC: total technical impact | Upgrade Dell iDRAC Service Module to version 6.1.1.0 or later (Dell advisory DSA-2026-458). | ||
| CVE-2026-119620 | NOISE | 29 | 25 | 25 | 40 | 7.3 | poc | poc_early | 37954679 | cak-filemanagement-system | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-62968 | NOISE | 29 | 25 | 0 | 65 | 8.7 | none | none | arsmotorin | dreamdisplays | 2026-10-30 | CISA SSVC: automatable | Upgrade Dream Displays to version 1.8.2 or later; versions from 1.5.0 up to 1.8.2 are affected. | |||
| CVE-2026-106078 | NOISE | 29 | 0 | 75 | 40 | 6.9 | 17.9 | none | veeam | backup for microsoft 365 | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-2270 | NOISE | 29 | 3 | 70 | 40 | 5.9 | 27.2 | none | none | kubernetes | kubernetes | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-115188 | NOISE | 29 | 19 | 13 | 65 | 9.9 | none | none | affected product not stated | 2026-10-26 | CISA SSVC: total technical impact | Upgrade Mautic to 7.2.2 or later; if upgrading is not possible, restrict the campaign import create permission to trusted administrators and harden web server configuration. | ||||
| CVE-2026-112634 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 47.9 | none | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-86974 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86984 | NOISE | 28 | 0 | 70 | 40 | 12.4 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86985 | NOISE | 28 | 0 | 70 | 40 | 7.8 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86986 | NOISE | 28 | 0 | 70 | 40 | 7.8 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118014 | NOISE | 28 | 0 | 70 | 40 | 4.2 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112467 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99201 | NOISE | 28 | 0 | 70 | 40 | 5.2 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112497 | NOISE | 28 | 0 | 70 | 40 | 13.2 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-48380 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 8.3 | none | none | adobe | adobe substance 3d painter | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-112498 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118559 | NOISE | 28 | 0 | 70 | 40 | 0.7 | none | drupal | commerce stripe | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99183 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99186 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112518 | NOISE | 28 | 0 | 70 | 40 | 12.7 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112601 | NOISE | 28 | 0 | 70 | 40 | 9.5 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112625 | NOISE | 28 | 0 | 70 | 40 | 11.9 | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112681 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112698 | NOISE | 28 | 0 | 70 | 40 | 14.0 | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84604 | NOISE | 28 | 0 | 70 | 40 | 15.1 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86880 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-106484 | NOISE | 28 | 0 | 70 | 40 | 4.4 | 1.9 | none | none | chrome-devtools-mcp | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-68866 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 12.7 | none | none | dell | powerprotect data domain | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-117530 | NOISE | 28 | 0 | 70 | 40 | 6.7 | 1.3 | none | jetbrains | junie cli | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-92375 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 0.9 | none | teamviewer | full client · host · remote management – monitoring | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118177 | NOISE | 28 | 0 | 70 | 40 | 7.5 | none | mozilla | thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118174 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | mozilla | thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-92376 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 2.6 | none | teamviewer | remote management – monitoring | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119713 | NOISE | 28 | 17 | 13 | 65 | 8.8 | none | none | paperclipai | @paperclipai/server | 2026-10-30 | CISA SSVC: total technical impact | Upgrade @paperclipai/server to 2026.416.0 or later; versions 2026.403.0 before 2026.416.0 are affected. | |||
| CVE-2026-118090 | NOISE | 28 | 17 | 13 | 65 | 8.8 | none | none | stylemix | masterstudy lms | 2026-10-30 | CISA SSVC: total technical impact | Update MasterStudy LMS to 3.7.56 or a higher version. | |||
| CVE-2026-118018 | NOISE | 28 | 0 | 70 | 40 | 2.8 | none | mozilla | firefox | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117967 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112442 | NOISE | 28 | 0 | 70 | 40 | 11.2 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117986 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117911 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99149 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112487 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112479 | NOISE | 28 | 0 | 70 | 40 | 13.5 | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99123 | NOISE | 28 | 0 | 70 | 40 | 7.1 | 6.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117951 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112451 | NOISE | 28 | 0 | 70 | 40 | 25.5 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112424 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117895 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117905 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117922 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117942 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117925 | NOISE | 28 | 0 | 70 | 40 | 9.2 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117930 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117936 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117952 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116235 | NOISE | 28 | 24 | 13 | 50 | 9.1 | 49.1 | poc | poc_early | oray | pugongying x5 pro | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-117956 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117990 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117992 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117915 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117899 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117866 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117860 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114525 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | drupal | abc | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117873 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114528 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | drupal | zero point | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114529 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | drupal | csv field | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114536 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | drupal | uswds paragraph components | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114537 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | view unpublished | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114540 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | domain | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114546 | NOISE | 28 | 0 | 70 | 40 | 4.2 | none | drupal | media alias display | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114547 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | tinypng | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114548 | NOISE | 28 | 0 | 70 | 40 | 4.2 | none | drupal | imageapi optimize webp | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114554 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | ai file to text | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118540 | NOISE | 28 | 0 | 70 | 40 | 4.0 | none | drupal | commerce core | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118541 | NOISE | 28 | 0 | 70 | 40 | 4.0 | none | drupal | commerce core | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118572 | NOISE | 28 | 0 | 70 | 40 | 7.8 | none | drupal | oauth login – oauth oidc sso | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-77152 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | drupal | field collection for drupal 7 | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112672 | NOISE | 28 | 0 | 70 | 40 | 13.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112669 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | apple | safari · ios and ipados · macos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86925 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 11.6 | none | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-20942 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 50.7 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-99121 | NOISE | 28 | 0 | 70 | 40 | 6.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99138 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99139 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99159 | NOISE | 28 | 0 | 70 | 40 | 6.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99160 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99167 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 7.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99175 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99206 | NOISE | 28 | 0 | 70 | 40 | 5.2 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112611 | NOISE | 28 | 0 | 70 | 40 | 14.0 | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112607 | NOISE | 28 | 0 | 70 | 40 | 25.2 | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112684 | NOISE | 28 | 0 | 70 | 40 | 9.0 | none | apple | safari · ios and ipados · macos +3 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112689 | NOISE | 28 | 0 | 70 | 40 | 14.3 | none | apple | ios and ipados · macos · tvos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118581 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 8.9 | none | mongodb | java driver | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116485 | NOISE | 28 | 24 | 0 | 65 | 9.8 | nuclei | poc_early | huangxd- | danmu_api | 2026-10-26 | public detection template exists (nuclei) | Upgrade to danmu_api 1.21.7 or later, which is unaffected; versions below 1.21.7 are affected. | |||
| CVE-2026-117973 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84493 | NOISE | 28 | 0 | 70 | 40 | 11.0 | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115913 | NOISE | 28 | 0 | 25 | 85 | 6.5 | 23.2 | none | vllm, vllm-project | vllm | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-84599 | NOISE | 28 | 0 | 70 | 40 | 8.4 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84633 | NOISE | 28 | 0 | 70 | 40 | 3.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84634 | NOISE | 28 | 0 | 70 | 40 | 6.3 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86923 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86945 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86946 | NOISE | 28 | 0 | 70 | 40 | 12.4 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115189 | NOISE | 28 | 17 | 13 | 65 | 8.8 | none | none | affected product not stated | 2026-10-26 | CISA SSVC: total technical impact | Upgrade Mautic to 5.2.12, 6.0.10 or 7.2.2 or later; if upgrading is not possible, restrict core:themes:create to trusted administrators only. | ||||
| CVE-2026-99173 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 6.2 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99180 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 7.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118147 | NOISE | 28 | 1 | 70 | 40 | 7.4 | none | microsoft | microsoft visual studio 2017 version 15.9 · microsoft visual studio 2019 version 16.11 · microsoft visual studio 2022 version 17.14 +1 more | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99155 | NOISE | 28 | 0 | 70 | 40 | 7.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99181 | NOISE | 28 | 0 | 70 | 40 | 8.2 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99182 | NOISE | 28 | 0 | 70 | 40 | 6.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113946 | NOISE | 28 | 0 | 70 | 40 | 8.5 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113906 | NOISE | 28 | 0 | 70 | 40 | 4.6 | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112630 | NOISE | 28 | 0 | 70 | 40 | 13.5 | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99212 | NOISE | 28 | 0 | 70 | 40 | 7.0 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99202 | NOISE | 28 | 0 | 70 | 40 | 6.0 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99179 | NOISE | 28 | 0 | 70 | 40 | 6.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99116 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 6.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115522 | NOISE | 28 | 0 | 70 | 40 | 5.3 | 31.7 | none | agent development kit (adk) for python | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112455 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 5.3 | none | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-90726 | NOISE | 28 | 0 | 70 | 40 | 6.0 | 2.1 | none | none | dell | powerprotect data domain | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-87097 | NOISE | 28 | 0 | 70 | 40 | 5.3 | 13.0 | none | acronis | acronis cyber protect 17 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87879 | NOISE | 28 | 0 | 70 | 40 | 5.9 | 12.1 | none | acronis | acronis cyber protect 17 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87098 | NOISE | 28 | 0 | 70 | 40 | 3.1 | 7.4 | none | acronis | acronis cyber protect 17 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-90724 | NOISE | 28 | 0 | 70 | 40 | 2.7 | 8.2 | none | dell | powerprotect data domain management center | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-86386 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 11.3 | none | dell | powerprotect data domain management center | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-90723 | NOISE | 28 | 0 | 70 | 40 | 2.7 | 8.2 | none | dell | powerprotect data domain management center | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118023 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118022 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118021 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118020 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118019 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118016 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118015 | NOISE | 28 | 0 | 70 | 40 | 4.2 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118013 | NOISE | 28 | 0 | 70 | 40 | 4.2 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118012 | NOISE | 28 | 0 | 70 | 40 | 4.2 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118011 | NOISE | 28 | 0 | 70 | 40 | 4.2 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118010 | NOISE | 28 | 0 | 70 | 40 | 4.2 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118009 | NOISE | 28 | 0 | 70 | 40 | 4.2 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118004 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118003 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117999 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117998 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117997 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117996 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117965 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117963 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117962 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117960 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117955 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117954 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117950 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117949 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117948 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117947 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117946 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117945 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117928 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117927 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117924 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117923 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117906 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117903 | NOISE | 28 | 0 | 70 | 40 | 9.9 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117902 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117901 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117900 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117897 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117896 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117894 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117893 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117863 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117862 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117861 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112658 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 4.6 | none | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112558 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112555 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112554 | NOISE | 28 | 0 | 70 | 40 | 12.7 | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112553 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112551 | NOISE | 28 | 0 | 70 | 40 | 10.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112550 | NOISE | 28 | 0 | 70 | 40 | 10.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112699 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112704 | NOISE | 28 | 0 | 70 | 40 | 11.5 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113938 | NOISE | 28 | 0 | 70 | 40 | 9.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113910 | NOISE | 28 | 0 | 70 | 40 | 14.2 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113915 | NOISE | 28 | 0 | 70 | 40 | 15.5 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113935 | NOISE | 28 | 0 | 70 | 40 | 9.5 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112606 | NOISE | 28 | 0 | 70 | 40 | 15.1 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113937 | NOISE | 28 | 0 | 70 | 40 | 6.9 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113942 | NOISE | 28 | 0 | 70 | 40 | 9.5 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113950 | NOISE | 28 | 0 | 70 | 40 | 12.7 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112604 | NOISE | 28 | 0 | 70 | 40 | 11.5 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112705 | NOISE | 28 | 0 | 70 | 40 | 14.8 | none | apple | ios and ipados · macos · tvos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112707 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112608 | NOISE | 28 | 0 | 70 | 40 | 6.5 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113945 | NOISE | 28 | 0 | 70 | 40 | 7.8 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113948 | NOISE | 28 | 0 | 70 | 40 | 9.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112640 | NOISE | 28 | 0 | 70 | 40 | 9.0 | none | apple | safari · ios and ipados · macos +3 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112656 | NOISE | 28 | 0 | 70 | 40 | 15.1 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112693 | NOISE | 28 | 0 | 70 | 40 | 8.4 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112566 | NOISE | 28 | 0 | 70 | 40 | 13.5 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112454 | NOISE | 28 | 0 | 70 | 40 | 11.5 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112456 | NOISE | 28 | 0 | 70 | 40 | 10.3 | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112459 | NOISE | 28 | 0 | 70 | 40 | 13.5 | none | apple | ios and ipados · macos · tvos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112464 | NOISE | 28 | 0 | 70 | 40 | 13.1 | none | apple | ios and ipados · macos · tvos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112466 | NOISE | 28 | 0 | 70 | 40 | 13.8 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112468 | NOISE | 28 | 0 | 70 | 40 | 13.1 | none | apple | ios and ipados · macos · tvos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112525 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112529 | NOISE | 28 | 0 | 70 | 40 | 10.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112531 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112536 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112546 | NOISE | 28 | 0 | 70 | 40 | 11.7 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-65368 | NOISE | 28 | 0 | 70 | 40 | 13.8 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-65373 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-65385 | NOISE | 28 | 0 | 70 | 40 | 17.1 | none | apple | ios and ipados · visionos · watchos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84495 | NOISE | 28 | 0 | 70 | 40 | 15.5 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86958 | NOISE | 28 | 0 | 70 | 40 | 23.9 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86964 | NOISE | 28 | 0 | 70 | 40 | 12.7 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86966 | NOISE | 28 | 0 | 70 | 40 | 13.5 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86969 | NOISE | 28 | 0 | 70 | 40 | 13.9 | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86970 | NOISE | 28 | 0 | 70 | 40 | 14.2 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112629 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 48.7 | none | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-99136 | NOISE | 28 | 0 | 70 | 40 | 7.0 | 7.3 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-103092 | NOISE | 28 | 5 | 38 | 65 | 8.8 | 31.0 | none | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.4, following the documented prepare-to-upgrade and release-specific configuration steps. | ||
| CVE-2026-104314 | NOISE | 28 | 5 | 38 | 65 | 6.5 | 24.4 | none | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.4, following the Prepare to upgrade instructions and release-specific configuration changes. | ||
| CVE-2026-104316 | NOISE | 28 | 5 | 38 | 65 | 6.5 | 26.0 | none | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.4, following the Prepare to upgrade instructions and release-specific configuration changes. | ||
| CVE-2026-112506 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 3.3 | none | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112533 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 12.3 | none | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112547 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 6.8 | none | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112559 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 13.5 | none | none | apple | ios and ipados · macos · visionos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112701 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 6.8 | none | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112706 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 10.6 | none | none | apple | ios and ipados · tvos · visionos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-113896 | NOISE | 28 | 0 | 70 | 40 | 4.7 | 11.5 | none | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-118175 | NOISE | 28 | 0 | 70 | 40 | 7.5 | none | mozilla | thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99119 | NOISE | 28 | 0 | 70 | 40 | 5.5 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113908 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 5.2 | none | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116892 | NOISE | 28 | 17 | 13 | 65 | 6.1 | 11.4 | poc | poc_early | semantic-mediawiki, semanticmediawiki | semantic_mediawiki · semanticmediawiki | 2026-10-27 | CISA SSVC: public proof of concept | Upgrade SemanticMediaWiki to 7.3.1 or later; versions from 3.1.0 before 7.3.1 are affected. | ||
| CVE-2026-116233 | NOISE | 28 | 24 | 13 | 50 | 9.1 | 39.9 | poc | poc_early | oray | pugongying x5 pro | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-112523 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99107 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99177 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112614 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 42.3 | none | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-107255 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | restrict route by ip | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114539 | NOISE | 28 | 0 | 70 | 40 | 9.0 | none | drupal | doccheck basic | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114541 | NOISE | 28 | 0 | 70 | 40 | 1.0 | none | drupal | frontend editing | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114543 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | simple user management | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114571 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | rabbit hole | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114555 | NOISE | 28 | 0 | 70 | 40 | 3.5 | 6.2 | none | none | drupal | data field | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-118546 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | drupal | ai (artificial intelligence) | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118548 | NOISE | 28 | 0 | 70 | 40 | 4.4 | none | drupal | ai (artificial intelligence) | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118557 | NOISE | 28 | 0 | 70 | 40 | 3.2 | none | drupal | commerce shipping | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118558 | NOISE | 28 | 0 | 70 | 40 | 0.9 | none | drupal | commerce stripe | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118561 | NOISE | 28 | 0 | 70 | 40 | 3.8 | none | drupal | single content sync | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99099 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 5.4 | none | linux | linux | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112346 | NOISE | 28 | 16 | 13 | 65 | 9.8 | none | openhands | openhands software agent sdk | 2026-10-26 | no exploitation evidence in any monitored source | Upgrade OpenHands Software Agent SDK to 1.52.0 or later, which contains the patch commit for the unauthenticated sandbox agent server. | ||||
| CVE-2026-99088 | NOISE | 28 | 0 | 70 | 40 | 5.6 | none | linux | linux | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112482 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112480 | NOISE | 28 | 0 | 70 | 40 | 13.2 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112519 | NOISE | 28 | 0 | 70 | 40 | 12.4 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112521 | NOISE | 28 | 0 | 70 | 40 | 14.2 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112543 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112545 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112560 | NOISE | 28 | 0 | 70 | 40 | 13.5 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112563 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | macos · tvos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112567 | NOISE | 28 | 0 | 70 | 40 | 16.0 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112622 | NOISE | 28 | 0 | 70 | 40 | 14.0 | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112624 | NOISE | 28 | 0 | 70 | 40 | 16.0 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112627 | NOISE | 28 | 0 | 70 | 40 | 14.8 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112666 | NOISE | 28 | 0 | 70 | 40 | 8.4 | none | apple | safari · ios and ipados · macos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112680 | NOISE | 28 | 0 | 70 | 40 | 7.0 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113899 | NOISE | 28 | 0 | 70 | 40 | 13.2 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113904 | NOISE | 28 | 0 | 70 | 40 | 7.8 | none | apple | safari · ios and ipados · macos +3 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-64750 | NOISE | 28 | 0 | 70 | 40 | 13.8 | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-65350 | NOISE | 28 | 0 | 70 | 40 | 15.4 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91914 | NOISE | 28 | 0 | 70 | 40 | 7.1 | none | none | dell | openmanage enterprise | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111499 | NOISE | 28 | 0 | 70 | 40 | 5.5 | none | none | dell | openmanage enterprise | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111498 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | none | dell | openmanage enterprise | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111500 | NOISE | 28 | 0 | 70 | 40 | 5.4 | none | none | dell | openmanage enterprise | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101209 | NOISE | 28 | 0 | 70 | 40 | 2.7 | none | none | dell | openmanage enterprise | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111501 | NOISE | 28 | 0 | 70 | 40 | 5.4 | none | none | dell | openmanage enterprise | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111502 | NOISE | 28 | 0 | 70 | 40 | 4.3 | none | none | dell | openmanage enterprise | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111503 | NOISE | 28 | 0 | 70 | 40 | 7.1 | none | none | dell | openmanage enterprise | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-86383 | NOISE | 28 | 0 | 70 | 40 | 6.8 | 39.8 | none | dell | powerprotect data domain | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-86390 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 25.7 | none | dell | powerprotect data domain | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110540 | NOISE | 28 | 0 | 70 | 40 | 7.1 | 24.5 | none | dell | powerprotect data domain management center | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110499 | NOISE | 28 | 25 | 13 | 50 | 8.7 | none | none | mtrudel | bandit | 2026-10-26 | CISA SSVC: automatable | No fixed release is stated; from 0.7.0 cap requests per HTTP/2 connection (e.g. http_2_options: [max_requests: 1000]) or disable HTTP/2 with http_2_options: [enabled: false]. | |||
| CVE-2026-108529 | NOISE | 28 | 25 | 13 | 50 | 8.7 | none | none | mtrudel | bandit | 2026-10-26 | CISA SSVC: automatable | Bound client streams with http_2_options: [default_local_settings: [max_concurrent_streams: 100]] (from 1.9.0), or disable HTTP/2 with http_2_options: [enabled: false] (from 0.7.0). | |||
| CVE-2026-108525 | NOISE | 28 | 25 | 13 | 50 | 8.7 | none | none | mtrudel | bandit | 2026-10-26 | CISA SSVC: automatable | From 0.7.0, disable HTTP/2 with http_2_options: [enabled: false], which removes the vulnerable path; no fixed release is stated. | |||
| CVE-2026-101034 | NOISE | 28 | 0 | 70 | 40 | 6.8 | 4.1 | none | broadcom | symantec ghost solution suite | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117870 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84545 | NOISE | 28 | 0 | 70 | 40 | 15.8 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-65363 | NOISE | 28 | 0 | 70 | 40 | 13.9 | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86973 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | apple | safari · ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112577 | NOISE | 28 | 0 | 70 | 40 | 9.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86936 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115914 | NOISE | 28 | 0 | 25 | 85 | 6.5 | 33.9 | none | none | vllm, vllm-project | vllm | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112690 | NOISE | 28 | 0 | 70 | 40 | 28.8 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117991 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117979 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117971 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112647 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112692 | NOISE | 28 | 0 | 70 | 40 | 13.9 | none | apple | ios and ipados · tvos · visionos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105477 | NOISE | 28 | 0 | 70 | 40 | 7.3 | 2.7 | none | veeam | agent for linux | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99204 | NOISE | 28 | 0 | 70 | 40 | 5.2 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99203 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 6.4 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99192 | NOISE | 28 | 0 | 70 | 40 | 6.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99152 | NOISE | 28 | 0 | 70 | 40 | 7.5 | 8.8 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99150 | NOISE | 28 | 0 | 70 | 40 | 6.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99148 | NOISE | 28 | 0 | 70 | 40 | 7.0 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99147 | NOISE | 28 | 0 | 70 | 40 | 6.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99142 | NOISE | 28 | 0 | 70 | 40 | 7.1 | 7.1 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112670 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99132 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99126 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99124 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99122 | NOISE | 28 | 0 | 70 | 40 | 7.3 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99114 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99106 | NOISE | 28 | 0 | 70 | 40 | 6.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-61546 | NOISE | 28 | 19 | 25 | 50 | 8.8 | 7.7 | poc | poc_early | ankimcp | anki-mcp-server-addon | 2026-10-28 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | Upgrade anki-mcp-server-addon to version 0.21.0 or later, which restores DNS-rebinding protection. | ||
| CVE-2026-113576 | NOISE | 28 | 0 | 70 | 40 | 6.3 | 12.2 | none | none | adobe | adobe digital editions | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-43736 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 4.0 | none | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112685 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 5.2 | none | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-86983 | NOISE | 28 | 0 | 70 | 40 | 5.4 | none | apple | swift-crypto | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112678 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 4.5 | none | none | apple | ios and ipados · macos · visionos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-86920 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 14.8 | none | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112618 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 3.5 | none | none | apple | ios and ipados · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-22063 | NOISE | 28 | 0 | 70 | 40 | 6.0 | 3.1 | none | netapp | ontap 9 · storagegrid (formerly storagegrid webscale) · e-series santricity os controller software | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107671 | NOISE | 28 | 0 | 70 | 40 | 8.5 | 28.2 | none | veeam | one | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108142 | NOISE | 28 | 0 | 70 | 40 | 9.1 | 34.3 | none | veeam | backup and replication | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-92374 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 0.5 | none | teamviewer | full client · host | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87101 | NOISE | 28 | 0 | 70 | 40 | 6.2 | 0.7 | none | acronis | acronis cyber protect 17 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-103799 | NOISE | 28 | 0 | 70 | 40 | 9.6 | 27.6 | none | dell | powerprotect data domain management center | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to 8.9.0.0 or later (Feature Release), 7.13.1.90 or later (LTS2024), 8.3.1.50 or later (LTS2025), or 8.6.1.30 or later (LTS2026); see Dell DSA-2026-416. | |||
| CVE-2026-104351 | NOISE | 28 | 1 | 70 | 40 | 9.9 | 47.3 | none | adobe | adobe campaign classic | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to Adobe Campaign Classic 7.4.4 build 9403 or later; versions up to and including 7.4.4 build 9402 are affected. | |||
| CVE-2026-105779 | NOISE | 28 | 0 | 70 | 40 | 9.1 | 22.2 | none | adobe | adobe campaign classic | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to Adobe Campaign Classic 7.4.4 build 9403 or later; versions up to and including 7.4.4 build 9402 are affected. | |||
| CVE-2026-105781 | REVIEW | 28 | 1 | 70 | 40 | 10.0 | 44.1 | none | adobe | adobe campaign classic | 2026-10-27 | Pre-authentication SQL injection in Adobe Campaign Classic with CVSS 10.0 and scope change, but no exploitation signal: EPSS 0.005, no KEV, no public exploit or detection template, and the product is niche. | Upgrade Adobe Campaign Classic to 7.4.4 build 9403 or later (APSB26-162); builds up to 7.4.4 build 9402 are affected. Until the upgrade window, restrict console and web access to trusted networks and review database logs for anomalous SQL. | |||
| CVE-2026-104350 | NOISE | 28 | 0 | 70 | 40 | 9.3 | 49.0 | none | adobe | adobe campaign classic | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to Adobe Campaign Classic 7.4.4 build 9403 or later; versions up to and including 7.4.4 build 9402 are affected (see Adobe advisory APSB26-162). | |||
| CVE-2026-105780 | NOISE | 28 | 1 | 70 | 40 | 9.9 | 42.1 | none | adobe | adobe campaign classic | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade Adobe Campaign Classic to 7.4.4 build 9403 or later; versions up to and including 7.4.4 build 9402 are affected. | |||
| CVE-2026-90719 | NOISE | 28 | 0 | 70 | 40 | 2.7 | 8.2 | none | dell | powerprotect data domain management center | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-86401 | NOISE | 28 | 0 | 70 | 40 | 2.7 | 8.2 | none | dell | powerprotect data domain management center | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99210 | NOISE | 28 | 0 | 70 | 40 | 4.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99189 | NOISE | 28 | 0 | 70 | 40 | 6.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99188 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99184 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99168 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99162 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109220 | NOISE | 28 | 16 | 13 | 65 | 9.8 | none | addonsorg | pdf invoice for woocommerce + drag and drop template builder | 2026-10-31 | no exploitation evidence in any monitored source | Upgrade the PDF Invoice for WooCommerce plugin to version 7.2.0 or later (7.2.0 download available from wordpress.org). | ||||
| CVE-2026-99151 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99145 | NOISE | 28 | 0 | 70 | 40 | 5.5 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-63377 | NOISE | 28 | 16 | 13 | 65 | 9.8 | none | fctr-id | okta-ai-agent | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to version 3.0.1-beta or later, which fixes the unauthenticated setup endpoint. | ||||
| CVE-2026-99137 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117987 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117985 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99163 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 7.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117984 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117983 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117982 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118576 | NOISE | 28 | 0 | 70 | 40 | 4.8 | none | drupal | stage file proxy | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117981 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118552 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | drupal | ai (artificial intelligence) | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117978 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117974 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118551 | NOISE | 28 | 0 | 70 | 40 | 4.2 | none | drupal | ai (artificial intelligence) | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117972 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117970 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117969 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114535 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | swiper formatter | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114534 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | drupal | block attributes | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114532 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | drupal | ui icons | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117968 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114531 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | drupal | swiper formatter | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117966 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114530 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | dopup | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99164 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 5.5 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117921 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117919 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117918 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117917 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117916 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117914 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117913 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117912 | NOISE | 28 | 0 | 70 | 40 | 9.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117910 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117909 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117891 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117890 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117887 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119420 | NOISE | 28 | 9 | 13 | 80 | 8.8 | none | getlago | lago | 2026-10-30 | no exploitation evidence in any monitored source | Apply the upstream patch commit 5a9d5935b027d1db7171c7c015283d5870451305 (lago-api PR #6146); versions through 1.55.0 are affected. | ||||
| CVE-2026-117885 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117879 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86388 | NOISE | 28 | 0 | 70 | 40 | 5.3 | 24.2 | none | dell | powerprotect data domain | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117878 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117868 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117867 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117865 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117864 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99090 | NOISE | 28 | 0 | 70 | 40 | 5.6 | none | linux | linux | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116738 | NOISE | 28 | 24 | 25 | 40 | 8.8 | 54.1 | none | none | kisli | vmime | 2026-10-26 | CISA SSVC: automatable; CISA SSVC: total technical impact | Apply the upstream patch in kisli/vmime PR #363 (commit e85925eddc638939f0eeb7ee55ec047d04a760d8), which fixes the uuEncoder::decode underflow; no fixed release version is named. | ||
| CVE-2026-114409 | NOISE | 28 | 0 | 70 | 40 | 5.7 | 1.1 | none | docker | docker desktop | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118002 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76654 | NOISE | 28 | 0 | 70 | 40 | 5.8 | 36.9 | none | kubernetes | kubernetes | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117958 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99174 | NOISE | 28 | 0 | 70 | 40 | 6.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117940 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117937 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117898 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112513 | NOISE | 28 | 0 | 70 | 40 | 6.9 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112514 | NOISE | 28 | 0 | 70 | 40 | 14.2 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112515 | NOISE | 28 | 0 | 70 | 40 | 13.8 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117881 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112571 | NOISE | 28 | 0 | 70 | 40 | 15.1 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112596 | NOISE | 28 | 0 | 70 | 40 | 14.0 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112595 | NOISE | 28 | 0 | 70 | 40 | 19.2 | none | apple | ios and ipados · macos · tvos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116631 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 11.6 | none | none | mozilla | firefox for ios | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116632 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 11.6 | none | none | mozilla | firefox for ios | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112673 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-88078 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 22.6 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-112665 | NOISE | 28 | 0 | 70 | 40 | 14.8 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112660 | NOISE | 28 | 0 | 70 | 40 | 15.9 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117871 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99093 | NOISE | 28 | 0 | 70 | 40 | none | linux | linux | 2026-10-26 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-112615 | NOISE | 28 | 0 | 70 | 40 | 9.0 | none | apple | safari · ios and ipados · macos +3 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112447 | NOISE | 28 | 0 | 70 | 40 | 13.7 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117980 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118000 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118006 | NOISE | 28 | 0 | 70 | 40 | 4.2 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119662 | NOISE | 28 | 24 | 0 | 65 | 8.8 | poc | poc_early | songloft-org | songloft | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | Upgrade to Songloft 2.13.6 or later, which removes the hardcoded admin/admin credentials. | |||
| CVE-2026-110190 | NOISE | 28 | 5 | 38 | 65 | 6.5 | 35.3 | none | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.5; for MCP stdio deployments also set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restart the service. | ||
| CVE-2026-115642 | NOISE | 28 | 16 | 13 | 65 | 8.3 | none | none | openstack | keystonemiddleware | 2026-10-30 | CISA SSVC: total technical impact | Upgrade keystonemiddleware to 13.0.2 or later (also fixed in 12.0.1 and 10.12.2 for the older branches). | |||
| CVE-2026-104309 | NOISE | 28 | 5 | 38 | 65 | 6.5 | 48.0 | none | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.4, following the Prepare to upgrade instructions and release-specific configuration changes. | ||
| CVE-2026-112619 | NOISE | 28 | 0 | 70 | 40 | 14.0 | none | apple | ios and ipados · macos · visionos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91912 | NOISE | 28 | 1 | 70 | 40 | 7.3 | none | none | dell | openmanage enterprise | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112620 | NOISE | 28 | 0 | 70 | 40 | 13.9 | none | apple | ios and ipados · macos · tvos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111582 | NOISE | 28 | 0 | 70 | 40 | 7.3 | 0.8 | none | teamviewer | remote management – monitoring | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87099 | NOISE | 28 | 0 | 70 | 40 | 5.7 | 15.3 | none | acronis | acronis cyber protect 17 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87100 | NOISE | 28 | 0 | 70 | 40 | 3.6 | 0.7 | none | acronis | acronis cyber protect 17 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112621 | NOISE | 28 | 0 | 70 | 40 | 14.0 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112652 | NOISE | 28 | 0 | 70 | 40 | 5.6 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112642 | NOISE | 28 | 0 | 70 | 40 | 14.8 | none | apple | ios and ipados · macos · tvos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112639 | NOISE | 28 | 0 | 70 | 40 | 9.9 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112638 | NOISE | 28 | 0 | 70 | 40 | 15.3 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112632 | NOISE | 28 | 0 | 70 | 40 | 14.8 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112653 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112676 | NOISE | 28 | 0 | 70 | 40 | 14.3 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112562 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112679 | NOISE | 28 | 0 | 70 | 40 | 10.3 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112686 | NOISE | 28 | 0 | 70 | 40 | 9.0 | none | apple | safari · ios and ipados · macos +3 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112539 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112413 | NOISE | 28 | 0 | 70 | 40 | 13.1 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112414 | NOISE | 28 | 0 | 70 | 40 | 16.8 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112416 | NOISE | 28 | 0 | 70 | 40 | 13.1 | none | apple | ios and ipados · macos · tvos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112423 | NOISE | 28 | 0 | 70 | 40 | 14.3 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112425 | NOISE | 28 | 0 | 70 | 40 | 13.1 | none | apple | ios and ipados · macos · tvos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112446 | NOISE | 28 | 0 | 70 | 40 | 13.8 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112449 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112453 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112461 | NOISE | 28 | 0 | 70 | 40 | 13.1 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112469 | NOISE | 28 | 0 | 70 | 40 | 13.1 | none | apple | ios and ipados · macos · tvos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112470 | NOISE | 28 | 0 | 70 | 40 | 13.8 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112473 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112475 | NOISE | 28 | 0 | 70 | 40 | 13.2 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112476 | NOISE | 28 | 0 | 70 | 40 | 13.8 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112486 | NOISE | 28 | 0 | 70 | 40 | 13.1 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112491 | NOISE | 28 | 0 | 70 | 40 | 13.1 | none | apple | ios and ipados · macos · tvos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112501 | NOISE | 28 | 0 | 70 | 40 | 14.2 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112512 | NOISE | 28 | 0 | 70 | 40 | 13.7 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86931 | NOISE | 28 | 0 | 70 | 40 | 10.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86937 | NOISE | 28 | 0 | 70 | 40 | 15.1 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86939 | NOISE | 28 | 0 | 70 | 40 | 11.5 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86941 | NOISE | 28 | 0 | 70 | 40 | 15.1 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86942 | NOISE | 28 | 0 | 70 | 40 | 14.8 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107266 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | views share | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86989 | NOISE | 28 | 0 | 70 | 40 | 4.6 | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86991 | NOISE | 28 | 0 | 70 | 40 | 18.0 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86992 | NOISE | 28 | 0 | 70 | 40 | 14.2 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84494 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112646 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 46.1 | none | none | apple | ios and ipados · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112429 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116505 | NOISE | 28 | 24 | 13 | 50 | 9.1 | 86.1 | poc | poc_early | totolink | a950rg | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-112434 | NOISE | 28 | 0 | 70 | 40 | 13.2 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112495 | NOISE | 28 | 0 | 70 | 40 | 10.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86978 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | ios and ipados · macos · tvos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118005 | NOISE | 28 | 0 | 70 | 40 | 4.2 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-61826 | NOISE | 28 | 16 | 13 | 65 | 10.0 | none | morpheus65535 | bazarr | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to Bazarr 1.5.7-beta.14 or later, which adds authentication to the Plex API namespace. | ||||
| CVE-2026-77819 | NOISE | 28 | 5 | 38 | 65 | 6.5 | 29.6 | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.4, following the Prepare to upgrade instructions and release-specific configuration changes. | |||
| CVE-2026-77817 | NOISE | 28 | 5 | 38 | 65 | 6.5 | 26.9 | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.5 or later; for MCP stdio deployments also set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restart the service. | |||
| CVE-2026-110200 | NOISE | 28 | 5 | 38 | 65 | 6.5 | 13.9 | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.5; for MCP stdio deployments also set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restart the service. | |||
| CVE-2026-110192 | NOISE | 28 | 5 | 38 | 65 | 6.5 | 16.2 | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to 1.13.0 or later (pip install langflow –upgrade, or pull the latest tagged Docker image). | |||
| CVE-2026-112671 | NOISE | 28 | 0 | 70 | 40 | 28.8 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99101 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117961 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112557 | NOISE | 28 | 0 | 70 | 40 | 13.7 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113914 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 6.8 | none | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-113912 | NOISE | 28 | 0 | 70 | 40 | 7.1 | 12.7 | none | none | apple | ios and ipados · macos · tvos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-114573 | NOISE | 28 | 0 | 70 | 40 | 15.8 | none | drupal | monster menus | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99128 | NOISE | 28 | 0 | 70 | 40 | 6.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99110 | NOISE | 28 | 0 | 70 | 40 | 7.0 | 8.2 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112609 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 7.7 | none | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-56084 | NOISE | 28 | 0 | 70 | 40 | 5.8 | none | dell | powerprotect data domain | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115918 | NOISE | 28 | 0 | 25 | 85 | 6.5 | 28.7 | none | none | vllm, vllm-project | vllm | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-115911 | NOISE | 28 | 0 | 25 | 85 | 6.5 | 24.1 | none | none | vllm, vllm-project | vllm | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-99190 | NOISE | 28 | 0 | 70 | 40 | 7.3 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84605 | NOISE | 28 | 0 | 70 | 40 | 5.8 | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84595 | NOISE | 28 | 0 | 70 | 40 | 12.5 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113936 | NOISE | 28 | 0 | 70 | 40 | 9.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113934 | NOISE | 28 | 0 | 70 | 40 | 9.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112535 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112532 | NOISE | 28 | 0 | 70 | 40 | 12.4 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112530 | NOISE | 28 | 0 | 70 | 40 | 13.2 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112511 | NOISE | 28 | 0 | 70 | 40 | 11.5 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112493 | NOISE | 28 | 0 | 70 | 40 | 12.4 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112492 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112488 | NOISE | 28 | 0 | 70 | 40 | 14.6 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118583 | NOISE | 28 | 0 | 70 | 40 | 2.8 | none | drupal | field permissions | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113900 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118574 | NOISE | 28 | 0 | 70 | 40 | 2.8 | none | drupal | s3 file system | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118573 | NOISE | 28 | 0 | 70 | 40 | 3.2 | none | drupal | oauth2 token manager | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118571 | NOISE | 28 | 0 | 70 | 40 | 3.3 | none | drupal | media alias display | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118570 | NOISE | 28 | 0 | 70 | 40 | 0.9 | none | drupal | fasttoggle | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118569 | NOISE | 28 | 0 | 70 | 40 | 3.2 | none | drupal | fasttoggle | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118568 | NOISE | 28 | 0 | 70 | 40 | 3.3 | none | drupal | content sync (content-sync.io) | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118555 | NOISE | 28 | 0 | 70 | 40 | 4.0 | none | drupal | commerce license | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118550 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | drupal | ai (artificial intelligence) | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118549 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | drupal | ai (artificial intelligence) | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118545 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | drupal | ai (artificial intelligence) | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118543 | NOISE | 28 | 0 | 70 | 40 | 2.4 | none | drupal | commerce core | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114553 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | frontend editing | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114545 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | fullcalendar view | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114544 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | media bulk upload | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114533 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | ágora transparency theme | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112602 | NOISE | 28 | 0 | 70 | 40 | 3.0 | none | apple | xcode | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86877 | NOISE | 28 | 0 | 70 | 40 | 4.4 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118025 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117993 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117939 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117888 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-65384 | NOISE | 28 | 0 | 70 | 40 | 16.5 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120338 | NOISE | 28 | 16 | 13 | 65 | 10.0 | none | prefecthq | prefab-ui | 2026-11-01 | no exploitation evidence in any monitored source | Upgrade prefab-ui to 0.21.0 or later, which revokes Deno read, write and network permissions before accepting code and starts Deno with –no-prompt. | ||||
| CVE-2026-120308 | NOISE | 28 | 11 | 26 | 65 | 9.9 | none | beam-cloud | beta9 gateway · beta9 worker | 2026-11-01 | no exploitation evidence in any monitored source | Upgrade the gateway to 0.1.776 or later and the worker to 0.1.756 or later; volume identifiers and mount paths are now validated and unowned volumes rejected. | ||||
| CVE-2026-112502 | NOISE | 28 | 0 | 70 | 40 | 14.2 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86971 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 47.7 | none | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112415 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 45.7 | none | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112654 | NOISE | 28 | 0 | 70 | 40 | 7.8 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112628 | NOISE | 28 | 0 | 70 | 40 | 14.3 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113898 | NOISE | 28 | 0 | 70 | 40 | 16.6 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113940 | NOISE | 28 | 0 | 70 | 40 | 9.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112576 | NOISE | 28 | 0 | 70 | 40 | 15.1 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-89270 | NOISE | 28 | 14 | 33 | 50 | 9.1 | none | popupbuilder | popup builder – create highly converting, mobile friendly marketing popups. | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112570 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112569 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112568 | NOISE | 28 | 0 | 70 | 40 | 11.6 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113941 | NOISE | 28 | 0 | 70 | 40 | 9.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112565 | NOISE | 28 | 0 | 70 | 40 | 13.5 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112599 | NOISE | 28 | 0 | 70 | 40 | 9.0 | none | apple | safari · ios and ipados · macos +3 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112697 | NOISE | 28 | 0 | 70 | 40 | 11.0 | none | apple | safari · ios and ipados · macos +3 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112612 | NOISE | 28 | 0 | 70 | 40 | 6.8 | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-96187 | NOISE | 28 | 0 | 70 | 40 | 7.4 | 43.8 | none | none | microsoft | microsoft edge (chromium-based) | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-113901 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113903 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113909 | NOISE | 28 | 0 | 70 | 40 | 14.0 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112682 | NOISE | 28 | 0 | 70 | 40 | 26.4 | none | apple | ios and ipados · macos · visionos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86990 | NOISE | 28 | 0 | 70 | 40 | 17.1 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99112 | NOISE | 28 | 0 | 70 | 40 | 7.1 | 8.1 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118567 | NOISE | 28 | 0 | 70 | 40 | 3.2 | none | drupal | bulk update user roles | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112675 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 4.1 | none | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112683 | NOISE | 28 | 0 | 70 | 40 | 14.3 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112696 | NOISE | 28 | 0 | 70 | 40 | 10.6 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112552 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112410 | NOISE | 28 | 0 | 70 | 40 | 25.5 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84528 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84498 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112695 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112430 | NOISE | 28 | 0 | 70 | 40 | 17.6 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112432 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112437 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107252 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 4.2 | none | none | drupal | mathjax: latex for drupal | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-112441 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112687 | NOISE | 28 | 0 | 70 | 40 | 11.5 | none | apple | ios and ipados · tvos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107258 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 3.5 | none | none | drupal | inline entity form dialog | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-107259 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 7.2 | none | none | drupal | linked field | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-112526 | NOISE | 28 | 0 | 70 | 40 | 31.9 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112443 | NOISE | 28 | 0 | 70 | 40 | 11.8 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112444 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107261 | NOISE | 28 | 0 | 70 | 40 | 4.2 | 9.0 | none | none | drupal | authenticator login plus (2fa) | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-112462 | NOISE | 28 | 0 | 70 | 40 | 15.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112477 | NOISE | 28 | 0 | 70 | 40 | 13.8 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107264 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 7.2 | none | none | drupal | inline formatter field | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-107265 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 5.3 | none | none | drupal | leaflet | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-107268 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 11.9 | none | none | drupal | two factor authentication – tfa / passwordless login | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-114572 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 9.0 | none | none | drupal | domain login restrict | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-112478 | NOISE | 28 | 0 | 70 | 40 | 9.8 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118264 | REVIEW | 28 | 19 | 33 | 40 | 9.1 | 37.2 | none | none | labstack | echo | 2026-10-28 | Pre-auth, no-user-interaction auth bypass in Echo’s Proxy middleware (CVSS 9.1), but exploitation requires a specific chain: an accessible proxy route, an upstream that rejects the WebSocket upgrade, and no independent upstream authorization. No public exploit or KEV listing. | Upgrade to Echo 4.16.1+ (4.x) or 5.4.1+ (5.x) and restart the service. Until patched, avoid exposing Echo Proxy routes to the internet and ensure upstream services enforce their own authentication rather than relying on Echo route middleware. | ||
| CVE-2026-86954 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 15.5 | none | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-107306 | NOISE | 28 | 0 | 70 | 40 | 3.8 | 5.3 | none | none | drupal | menu link attributes | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-107307 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 3.5 | none | none | drupal | smartlinker ai | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-107039 | NOISE | 28 | 20 | 33 | 40 | 7.5 | 9.7 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-107308 | NOISE | 28 | 0 | 70 | 40 | 3.1 | 5.3 | none | none | drupal | country | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-107309 | NOISE | 28 | 0 | 70 | 40 | 3.7 | 3.5 | none | none | drupal | easy breadcrumb | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-107311 | NOISE | 28 | 0 | 70 | 40 | 3.7 | 4.2 | none | none | drupal | permissions by term | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-107312 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 4.2 | none | none | drupal | examples for developers | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-112516 | NOISE | 28 | 0 | 70 | 40 | 14.2 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112517 | NOISE | 28 | 0 | 70 | 40 | 14.2 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112522 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112524 | NOISE | 28 | 0 | 70 | 40 | 12.4 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84542 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117880 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84590 | NOISE | 28 | 0 | 70 | 40 | 25.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118564 | NOISE | 28 | 0 | 70 | 40 | 3.8 | none | drupal | payumoney for drupal commerce | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86896 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112575 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118560 | NOISE | 28 | 0 | 70 | 40 | 4.8 | none | drupal | commerce stripe | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118556 | NOISE | 28 | 0 | 70 | 40 | 4.0 | none | drupal | commerce shipping | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86972 | NOISE | 28 | 0 | 70 | 40 | 15.6 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118554 | NOISE | 28 | 0 | 70 | 40 | 9.0 | none | drupal | openid connect client | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99103 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117882 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118553 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | drupal | ai (artificial intelligence) | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99113 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118544 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | commerce core | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118542 | NOISE | 28 | 0 | 70 | 40 | 4.0 | none | drupal | commerce core | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-108515 | NOISE | 28 | 0 | 70 | 40 | 9.5 | none | drupal | drupal core | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99215 | NOISE | 28 | 0 | 70 | 40 | 5.2 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112616 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 11.6 | none | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112534 | NOISE | 28 | 0 | 70 | 40 | 13.7 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112617 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 12.4 | none | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-104331 | NOISE | 28 | 5 | 38 | 65 | 5.4 | 6.0 | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.4, following the Prepare to upgrade instructions and release-specific configuration changes. | |||
| CVE-2026-118017 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99134 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-90731 | NOISE | 28 | 0 | 70 | 40 | 4.9 | 17.2 | none | none | dell | powerprotect data domain | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-118007 | NOISE | 28 | 0 | 70 | 40 | 4.2 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86968 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86943 | NOISE | 28 | 0 | 70 | 40 | 14.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112421 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117872 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107310 | NOISE | 28 | 0 | 70 | 40 | 4.3 | 3.5 | none | none | drupal | freelinking | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-112605 | NOISE | 28 | 0 | 70 | 40 | 3.0 | none | apple | xcode | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107256 | NOISE | 28 | 0 | 70 | 40 | 7.8 | none | drupal | shield | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107260 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | drupal | sector distribution | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-108097 | NOISE | 28 | 0 | 70 | 40 | 25.7 | none | drupal | drupal core | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-108099 | NOISE | 28 | 0 | 70 | 40 | 24.8 | none | drupal | entity list | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-108514 | NOISE | 28 | 0 | 70 | 40 | 9.5 | none | drupal | drupal core | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110738 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | drupal | gin admin theme | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86988 | NOISE | 28 | 0 | 70 | 40 | 12.7 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114523 | NOISE | 28 | 0 | 70 | 40 | 44.6 | none | drupal | ffmpeg image toolkit | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114524 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | drupal | custom formatters | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114526 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | drupal | black hole | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114527 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | drupal | ui icons | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114538 | NOISE | 28 | 0 | 70 | 40 | 5.3 | none | drupal | bootstrap | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114542 | NOISE | 28 | 0 | 70 | 40 | 4.2 | none | drupal | simple oauth (oauth2) & openid connect | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118562 | NOISE | 28 | 0 | 70 | 40 | 19.0 | none | drupal | single content sync | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107263 | NOISE | 28 | 0 | 70 | 40 | 5.4 | 3.5 | none | none | drupal | gutenberg | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-84627 | NOISE | 28 | 0 | 70 | 40 | 15.5 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84614 | NOISE | 28 | 0 | 70 | 40 | 8.9 | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118563 | NOISE | 28 | 0 | 70 | 40 | 3.8 | none | drupal | cacheflush | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84594 | NOISE | 28 | 0 | 70 | 40 | 8.0 | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118565 | NOISE | 28 | 0 | 70 | 40 | 3.8 | none | drupal | groupex pro ( daxko ) integration | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84539 | NOISE | 28 | 0 | 70 | 40 | 11.5 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118575 | NOISE | 28 | 0 | 70 | 40 | 4.8 | none | drupal | signature pad widget | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118582 | NOISE | 28 | 0 | 70 | 40 | 7.8 | none | drupal | captcha | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118584 | NOISE | 28 | 0 | 70 | 40 | 2.8 | none | drupal | field permissions | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99094 | NOISE | 28 | 0 | 70 | 40 | 7.5 | 5.6 | none | linux | linux | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99097 | NOISE | 28 | 0 | 70 | 40 | none | linux | linux | 2026-10-26 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-99098 | NOISE | 28 | 0 | 70 | 40 | none | linux | linux | 2026-10-26 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-115916 | NOISE | 28 | 0 | 25 | 85 | 6.5 | 23.2 | none | vllm, vllm-project | vllm | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112481 | NOISE | 28 | 0 | 70 | 40 | 13.2 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112485 | NOISE | 28 | 0 | 70 | 40 | 13.1 | none | apple | ios and ipados · macos · tvos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112494 | NOISE | 28 | 0 | 70 | 40 | 11.7 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112500 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112504 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113952 | NOISE | 28 | 0 | 70 | 40 | 14.0 | none | apple | safari · ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113949 | NOISE | 28 | 0 | 70 | 40 | 8.7 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113944 | NOISE | 28 | 0 | 70 | 40 | 9.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112507 | NOISE | 28 | 0 | 70 | 40 | 6.2 | none | apple | ios and ipados | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112508 | NOISE | 28 | 0 | 70 | 40 | 12.4 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119763 | NOISE | 28 | 24 | 25 | 40 | 5.3 | poc | poc_early | thechangelog | changelog.com | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: automatable | ||||
| CVE-2026-112510 | NOISE | 28 | 0 | 70 | 40 | 27.9 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112537 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112540 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112548 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113897 | NOISE | 28 | 0 | 70 | 40 | 28.3 | none | apple | safari · ios and ipados · macos +1 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116111 | NOISE | 28 | 24 | 25 | 40 | 9.6 | 23.1 | poc | poc_early | 2k, 2k games | sid_meiers_civilization_v 1.0.3.144 | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-118510 | NOISE | 28 | 0 | 70 | 40 | 8.8 | 20.8 | none | mongodb | laravel mongodb | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade mongodb/laravel-mongodb to 5.12.0 or later; versions from 3.2.3 before 5.12.0 are affected. | |||
| CVE-2026-65397 | NOISE | 28 | 0 | 70 | 40 | 5.5 | 5.0 | none | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-90732 | NOISE | 28 | 0 | 70 | 40 | 4.9 | 17.2 | none | none | dell | powerprotect data domain | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-90725 | NOISE | 28 | 0 | 70 | 40 | 4.9 | 17.8 | none | none | dell | powerprotect data domain | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-86392 | NOISE | 28 | 0 | 70 | 40 | 4.9 | 27.4 | none | none | dell | powerprotect data domain | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-86391 | NOISE | 28 | 0 | 70 | 40 | 6.4 | 31.7 | none | none | dell | powerprotect data domain management center | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-86377 | NOISE | 28 | 0 | 70 | 40 | 7.6 | 23.1 | none | none | dell | powerprotect data domain | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-112691 | NOISE | 28 | 0 | 70 | 40 | 13.5 | none | apple | ios and ipados · visionos · watchos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-92372 | NOISE | 28 | 0 | 70 | 40 | 8.8 | 36.9 | none | teamviewer | full client | 2026-10-27 | no exploitation evidence in any monitored source | Update TeamViewer Full Client to version 15.83 or later; older 13.x and 14.7.x branches have their own fixed builds per the vendor bulletin TV-2026-1011. | |||
| CVE-2026-111585 | NOISE | 28 | 0 | 70 | 40 | 8.8 | 21.4 | none | teamviewer | full client · portable · remote control | 2026-10-27 | no exploitation evidence in any monitored source | Update TeamViewer Full Client, Portable and Remote Control to 15.83 or later; legacy Windows 7/8 builds to 15.64.10 and 14.7.x builds to 14.7.48868 or later. | |||
| CVE-2026-111583 | NOISE | 28 | 0 | 70 | 40 | 7.3 | 8.9 | none | teamviewer | full client · host | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-92377 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 1.2 | none | teamviewer | full client · host | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118179 | NOISE | 28 | 0 | 70 | 40 | 7.5 | none | mozilla | thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118176 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | mozilla | thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112610 | NOISE | 28 | 0 | 70 | 40 | 13.5 | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118180 | NOISE | 28 | 0 | 70 | 40 | 6.8 | none | mozilla | thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99125 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99111 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99108 | NOISE | 28 | 0 | 70 | 40 | 5.5 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99187 | NOISE | 28 | 0 | 70 | 40 | 6.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99102 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99158 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118026 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118024 | NOISE | 28 | 0 | 70 | 40 | 3.5 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99157 | NOISE | 28 | 0 | 70 | 40 | 6.6 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99156 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 7.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117995 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117994 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99143 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 6.2 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117989 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117988 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117977 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117975 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117944 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117943 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117941 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117938 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117934 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99135 | NOISE | 28 | 0 | 70 | 40 | 6.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99133 | NOISE | 28 | 0 | 70 | 40 | 6.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117933 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117931 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117929 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112668 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117907 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117877 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117876 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99115 | NOISE | 28 | 0 | 70 | 40 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117875 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117874 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117869 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-90727 | NOISE | 28 | 0 | 70 | 40 | 3.8 | 18.0 | none | dell | powerprotect data domain | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112483 | NOISE | 28 | 0 | 70 | 40 | 10.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-62331 | NOISE | 28 | 24 | 0 | 65 | 8.2 | none | none | mtzanidakis | praktor | 2026-10-30 | CISA SSVC: automatable | Upgrade to praktor 0.9.1 or later, which fixes the unsanitised filename path traversal in the Telegram upload handlers. | |||
| CVE-2026-111584 | NOISE | 28 | 0 | 70 | 40 | 7.3 | 1.2 | none | teamviewer | teamviewer remote – patch management | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117976 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109584 | NOISE | 28 | 25 | 13 | 50 | 8.7 | none | none | mtrudel | bandit | 2026-10-26 | CISA SSVC: automatable | On 1.12.2 and later, set a finite decoded header list limit, e.g. http_2_options: [default_local_settings: [max_header_list_size: 65_536]]; from 0.7.0, disabling HTTP/2 with http_2_options: [enabled: false] removes the v | |||
| CVE-2026-117953 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112417 | NOISE | 28 | 0 | 70 | 40 | 8.5 | none | apple | visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117920 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117904 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117892 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117886 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112474 | NOISE | 28 | 0 | 70 | 40 | 13.5 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112541 | NOISE | 28 | 0 | 70 | 40 | 12.3 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112542 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112561 | NOISE | 28 | 0 | 70 | 40 | 14.2 | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-64789 | NOISE | 28 | 0 | 70 | 40 | 15.1 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107254 | NOISE | 28 | 0 | 70 | 40 | 4.8 | 9.0 | none | none | drupal | authenticator login plus (2fa) | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-113913 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 49.2 | none | none | apple | ios and ipados · macos · visionos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112428 | NOISE | 28 | 0 | 70 | 40 | 13.7 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113907 | NOISE | 28 | 0 | 70 | 40 | 6.1 | 12.3 | none | none | apple | ios and ipados · macos · tvos +2 more | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-84610 | NOISE | 28 | 0 | 70 | 40 | 15.1 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112633 | NOISE | 28 | 0 | 70 | 40 | 6.5 | 46.2 | none | none | apple | ios and ipados · macos | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112593 | NOISE | 28 | 0 | 70 | 40 | 10.5 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117889 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118027 | NOISE | 28 | 0 | 70 | 40 | 2.8 | none | mozilla | firefox | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112505 | NOISE | 28 | 0 | 70 | 40 | 12.0 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117908 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117883 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117884 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117957 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117959 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117926 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117932 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-51905 | NOISE | 28 | 24 | 13 | 50 | 8.8 | 17.2 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-107060 | NOISE | 28 | 11 | 41 | 49 | 9.1 | 4.8 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-119979 | NOISE | 28 | 16 | 13 | 65 | 8.8 | none | none | element labs | lm studio | 2026-10-30 | CISA SSVC: automatable; CISA SSVC: total technical impact | Upgrade to LM Studio 0.4.22+1 or later, which fixes the path traversal in the model downloader. | |||
| CVE-2026-65392 | NOISE | 28 | 0 | 70 | 40 | 13.6 | none | apple | macos | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117935 | NOISE | 28 | 0 | 70 | 40 | 8.3 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107058 | NOISE | 28 | 25 | 13 | 49 | 9.8 | 41.9 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-99109 | NOISE | 28 | 0 | 70 | 40 | 7.8 | 5.5 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118178 | NOISE | 28 | 0 | 70 | 40 | 7.5 | none | mozilla | thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-99129 | NOISE | 28 | 0 | 70 | 40 | 4.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117964 | NOISE | 28 | 0 | 70 | 40 | 7.7 | none | mozilla | firefox · thunderbird | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-102590 | NOISE | 28 | 5 | 38 | 65 | 7.7 | 15.1 | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.4, following the documented prepare-to-upgrade and release-specific configuration steps. | |||
| CVE-2026-90721 | NOISE | 28 | 0 | 70 | 40 | 3.4 | 1.8 | none | none | dell | powerprotect data domain | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-104308 | NOISE | 28 | 5 | 38 | 65 | 4.3 | 26.2 | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.4, following the Prepare to upgrade instructions and release-specific configuration changes. | |||
| CVE-2026-99120 | NOISE | 28 | 0 | 70 | 40 | 6.8 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-104310 | NOISE | 28 | 5 | 38 | 65 | 4.3 | 15.1 | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.4, following the Prepare to upgrade instructions and release-specific configuration changes. | |||
| CVE-2026-104312 | NOISE | 28 | 5 | 38 | 65 | 6.8 | 11.4 | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.4 or later; versions 1.0.0 through 1.12.3 are affected. | |||
| CVE-2026-104315 | NOISE | 28 | 5 | 38 | 65 | 4.3 | 9.4 | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Langflow OSS to version 1.12.4, following the Prepare to upgrade instructions and release-specific configuration changes. | |||
| CVE-2026-62013 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 39.1 | none | none | themerex | edge decor | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-115968 | REVIEW | 27 | 21 | 25 | 40 | 9.8 | 35.1 | none | none | ultimate member | ultimate member | 2026-10-28 | CISA SSVC: automatable; CISA SSVC: total technical impact; floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Update the Ultimate Member WordPress plugin to version 2.14.0 or later. | ||
| CVE-2026-62002 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 43.6 | none | none | themerex | meals & wheels | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-62012 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 36.2 | none | none | themerex | coinpress | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-119122 | NOISE | 27 | 19 | 30 | 40 | 5.3 | 30.9 | poc | poc_early | unclecode | crawl4ai | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-54859 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 44.6 | none | none | themerex | preservation | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-61997 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 43.6 | none | none | themerex | legal stone | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-115693 | NOISE | 27 | 14 | 13 | 65 | 9.1 | none | benoitc | hackney | 2026-10-26 | no exploitation evidence in any monitored source | Upgrade hackney to 4.9.0 or later (fixed in commit 915eb5737e9c489d8fc22eec8cdae30e9b027be4); affected versions are 1.24.0 before 4.9.0. | ||||
| CVE-2026-119332 | NOISE | 27 | 14 | 0 | 80 | 8.8 | none | ladybirdbrowser | ladybird | 2026-10-30 | no exploitation evidence in any monitored source | Fixed in commit 209579c96473c75bd5eba9701fcadb841a045964; builds prior to that commit are affected. | ||||
| CVE-2026-116245 | NOISE | 27 | 7 | 13 | 80 | 8.2 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to pgAdmin 4 9.19 or later, which adds the SERVER_MODE_ALLOWED_SERVICES allowlist (empty by default), refuses the servicefile parameter, strips PGPASSWORD/PGSERVICE at startup and wraps the pg_dumpall database na | ||||
| CVE-2026-62017 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 36.2 | none | none | themerex | good homes | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-14467 | NOISE | 27 | 5 | 13 | 85 | 8.2 | 32.2 | none | none | forocoches | forocoches comments editor | 2026-10-30 | no exploitation evidence in any monitored source | The Forocoches team has fixed the vulnerability in the comments editor; affected versions are those before May 2026. | ||
| CVE-2026-62010 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 33.8 | none | none | themerex | avventure | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-62009 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 36.8 | none | none | themerex | filmax | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-54860 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 42.2 | none | none | themerex | ozisti | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-62005 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 33.8 | none | none | themerex | muzicon | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-62004 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 33.8 | none | none | themerex | motorix | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-117656 | NOISE | 27 | 15 | 13 | 65 | 9.3 | none | pow-auth | assent | 2026-10-31 | no exploitation evidence in any monitored source | Upgrade assent to 0.3.2 or later (affected: 0.1.25 before 0.3.2); if upgrade is not yet possible, delete the "user" parameter before calling Assent.Strategy.Apple.callback/2. | ||||
| CVE-2026-61729 | NOISE | 27 | 15 | 13 | 65 | 9.4 | none | socfortress | copilot | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to CoPilot 0.1.76 or later, and set unique values for GRAYLOG_API_HEADER_VALUE and VELOCIRAPTOR_API_HEADER_VALUE. | ||||
| CVE-2026-62003 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 33.8 | none | none | themerex | mission | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-119129 | NOISE | 27 | 17 | 25 | 50 | 8.1 | 20.9 | none | none | zitadel | zitadel | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | Upgrade to ZITADEL 4.19.5 or later; the 3.x line (3.0.0 through 3.4.15) is affected with no fixed 3.x version named. | ||
| CVE-2026-92885 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 30.6 | none | none | qode themes | qode membership | 2026-10-27 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-61671 | NOISE | 27 | 22 | 0 | 65 | 8.1 | 5.5 | poc | poc_early | labredescefetrj | wegia | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | Upgrade to WeGIA 3.8.7 or later, which adds ownership checks and CSRF validation to the affected Controle methods. | ||
| CVE-2026-105894 | NOISE | 27 | 22 | 13 | 50 | 8.8 | none | none | akbilisim | ak framework | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-117564 | REVIEW | 27 | 21 | 25 | 40 | 9.8 | 48.7 | none | none | buqiyuan | nest-admin | 2026-10-27 | A hardcoded JWT_SECRET in .env.production lets unauthenticated attackers forge admin tokens with no user interaction, but there is no observed exploitation, no public exploit code and EPSS sits at 0.006. | Upgrade nest-admin to 1.0.1 or later, which removes the hardcoded JWT_SECRET (commit f2cec8cb776cbf113115b33164dac69a46d24097), then restart the service. Rotate the JWT secret and invalidate existing tokens, since previously issued forged tokens remain valid until the secret changes. | ||
| CVE-2026-115245 | REVIEW | 27 | 21 | 25 | 40 | 9.8 | 40.0 | none | none | unknown | chat ai with dispatcher | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact; floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Update the Chat AI with Dispatcher WordPress plugin to version 2.4 or later. | ||
| CVE-2026-84999 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 41.6 | none | none | pie register | pie register premium | 2026-10-28 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-103039 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 43.4 | none | none | gravity forms | gravity forms | 2026-10-30 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-112345 | NOISE | 27 | 22 | 13 | 50 | 8.1 | poc | poc_early | sciener | ttlock | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | ||||
| CVE-2026-54857 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 42.2 | none | none | themerex | quirky | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-104012 | NOISE | 27 | 14 | 13 | 65 | 8.8 | none | roxnor | rox appointment booking – event, calendar & appointment scheduling | 2026-10-31 | no exploitation evidence in any monitored source | Upgrade Rox Appointment Booking to version 1.3.2 or later (1.3.2 download available from wordpress.org); all versions up to and including 1.3.1 are affected. | ||||
| CVE-2026-63378 | NOISE | 27 | 9 | 26 | 65 | 8.8 | none | fctr-id | okta-ai-agent | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to version 3.0.1-beta or later, which fixes the script validation bypass. | ||||
| CVE-2026-62011 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 33.8 | none | none | themerex | bonbon | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-54856 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 42.2 | none | none | themerex | rexcoin | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-62131 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 24.3 | none | none | zoho flow | zoho flow | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-91917 | NOISE | 27 | 10 | 58 | 30 | 8.0 | none | none | dell | openmanage enterprise | 2026-10-30 | CISA SSVC: total technical impact | Upgrade to Dell OpenManage Enterprise 4.8.0 or later, per Dell advisory DSA-2026-467. | |||
| CVE-2026-109516 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 47.5 | none | none | guruteam | bot for telegram on woocommerce | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-113616 | REVIEW | 27 | 21 | 25 | 40 | 9.8 | 27.7 | none | none | unknown | logixfast auth | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact; floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Update the LogixFast Auth WordPress plugin to version 1.0.4 or later. | ||
| CVE-2026-42922 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 45.1 | none | none | frangoteam | frangoteam | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-62016 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 33.8 | none | none | themerex | gamic | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-54858 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 42.2 | none | none | themerex | printy | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-62001 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 41.1 | none | none | themerex | marcell | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-62006 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 36.2 | none | none | themerex | nuts | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-62008 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 36.2 | none | none | themerex | orpheus | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-62018 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 39.1 | none | none | themerex | gunslinger | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-62015 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 33.8 | none | none | themerex | gamezone | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-113947 | NOISE | 27 | 0 | 78 | 30 | 8.8 | 43.8 | none | none | apple | macos | 2026-10-26 | CISA SSVC: total technical impact | Update to macOS Golden Gate 27.2 or later, which addresses the issue with improved access restrictions. | ||
| CVE-2026-61998 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 41.1 | none | none | themerex | le truffe | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-62014 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 36.8 | none | none | themerex | emojination | 2026-10-29 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-106013 | NOISE | 27 | 21 | 25 | 40 | 9.8 | 46.2 | none | none | artbees | jupiter x core | 2026-10-28 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-120306 | NOISE | 26 | 11 | 18 | 65 | 9.9 | none | beam-cloud | beta9 worker | 2026-11-01 | no exploitation evidence in any monitored source | Upgrade the Beta9 worker to 0.1.756 or later, which switches Buildah RUN steps to OCI isolation with private PID, IPC and network namespaces. | ||||
| CVE-2026-120307 | NOISE | 26 | 11 | 18 | 65 | 9.9 | none | beam-cloud | beta9 worker | 2026-11-01 | no exploitation evidence in any monitored source | Upgrade the Beta9 worker to 0.1.756 or later (commit a28bf12, PR 1897), which uses os.OpenRoot so parent-directory and symlink lookups stay inside the container root or mount source. | ||||
| CVE-2026-109411 | NOISE | 26 | 10 | 33 | 50 | 8.1 | 51.0 | none | none | samba, red hat | samba · red hat enterprise linux 10 · red hat enterprise linux 6 +5 more | 2026-10-28 | CISA SSVC: total technical impact | Disable the experimental vfs_ceph_rgw module: remove ceph_rgw from the vfs objects setting in the relevant share sections of /etc/samba/smb.conf and reload Samba. | ||
| CVE-2026-116254 | NOISE | 26 | 19 | 25 | 40 | 6.5 | 17.8 | poc | poc_early | rathena | fluxcp | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-116260 | NOISE | 26 | 20 | 25 | 40 | 7.3 | 22.0 | poc | poc_early | n/a | libimobiledevice | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-116874 | NOISE | 26 | 7 | 25 | 65 | 6.1 | 6.8 | none | none | semantic-mediawiki, semanticmediawiki | semantic_mediawiki · semanticmediawiki | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-120324 | NOISE | 26 | 13 | 13 | 65 | 8.3 | none | aklivity | zilla | 2026-11-02 | no exploitation evidence in any monitored source | Upgrade to Zilla 2.5.0-rc3 or later; the fix is commit 46a8b15cbea157f7ae8b7cb865809a02fd6b1988 (PR #2623). | ||||
| CVE-2026-7004 | NOISE | 26 | 12 | 38 | 40 | 6.1 | poc | poc_early | wit | synapps runtime | 2026-10-30 | CISA SSVC: public proof of concept | ||||
| CVE-2026-119572 | NOISE | 26 | 13 | 13 | 65 | 8.7 | none | traefik | traefik | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to Traefik 3.7.15 or later, which is unaffected. | ||||
| CVE-2026-116604 | NOISE | 26 | 19 | 25 | 40 | 6.5 | 47.1 | poc | poc_early | sourcecodester | online food ordering system | 2026-10-27 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-93865 | REVIEW | 26 | 19 | 25 | 40 | 9.2 | 40.1 | none | none | watchguard | fireware os | 2026-10-27 | Unauthenticated remote attacker can invoke privileged administrative actions on FireCluster management IP when clustering is enabled; CVSS 9.2. No exploitation signals yet (EPSS 0.0046, no KEV, no public exploit code), so it is not ACT_NOW. | Upgrade Fireware OS to 2026.4, 12.12.4, or 12.5.22 per the WatchGuard PSIRT advisory. Until upgraded, restrict access to the FireCluster management IP to trusted networks and confirm clustering is only enabled where required. | ||
| CVE-2026-116620 | NOISE | 26 | 20 | 25 | 40 | 7.3 | 23.2 | poc | poc_early | tencent | rapidjson | 2026-10-27 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-116507 | NOISE | 26 | 19 | 25 | 40 | 5.3 | 33.8 | poc | poc_early | totolink | a950rg | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-59179 | NOISE | 26 | 10 | 33 | 50 | 8.3 | 33.2 | poc | poc_early | naorsabag | openhop | 2026-10-28 | CISA SSVC: public proof of concept | Upgrade to OpenHop 0.3.7 or later, which fixes the path traversal in the flow routes. | ||
| CVE-2025-68394 | NOISE | 26 | 11 | 0 | 80 | 8.4 | none | none | arketeam | protectelmaj · bdf | 2026-10-30 | CISA SSVC: total technical impact | Upgrade to PROTECTELMAJ v6.5.19 or later, or BDF v6.4.67 or later. | |||
| CVE-2026-119195 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 44.6 | poc | poc_early | pyasn1 | pyasn1 | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-116748 | NOISE | 26 | 20 | 25 | 40 | 8.8 | 69.3 | none | nuclei | poc_early | transmission | transmission | 2026-10-26 | CISA SSVC: total technical impact; public detection template exists (nuclei) | Upgrade Transmission to 4.1.3 or later; the fix is in the 4.1.3 release (commit c6a1bd2, PR #8938). | |
| CVE-2026-106972 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 4.6 | poc | poc_early | n/a | n/a | 2026-10-28 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-115712 | NOISE | 26 | 5 | 63 | 30 | 4.3 | 15.8 | none | none | elastic | elastic_cloud_enterprise · elastic cloud enterprise | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to ECE 3.8.6 or 4.2.1 (or a later release verified to contain the fix); no workarounds exist. | ||
| CVE-2026-116236 | NOISE | 26 | 15 | 25 | 50 | 7.2 | 33.6 | poc | poc_early | oray | pugongying x5 pro | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-107047 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 37.7 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-117515 | NOISE | 26 | 20 | 25 | 40 | 7.3 | 35.5 | poc | poc_early | oretnom23 | php-travel-agency-system | 2026-10-27 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-118275 | NOISE | 26 | 19 | 25 | 40 | 5.3 | 37.1 | poc | poc_early | a2ui-project | a2ui | 2026-10-28 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-114358 | REVIEW | 26 | 20 | 25 | 40 | 9.3 | 43.0 | none | none | radius synergies | radius xenia m2m platform | 2026-10-29 | Unauthenticated SQL injection in the Xenia M2M web management interface, CVSS 9.3, reachable over the internet with no credentials or user interaction. No exploitation is observed and EPSS is 0.005, but the platform is rare and OT-adjacent, so exposure is narrow rather than absent. | Contact Radius Synergies for the patched build, since the advisory names no version number, and schedule the downtime the update requires. Until then, keep the web management interface off the internet, restrict it to trusted management networks or a VPN, and review database logs for anomalous queries. | ||
| CVE-2026-90868 | NOISE | 26 | 14 | 25 | 50 | 9.9 | 74.1 | none | none | progress software | ws_ftp server | 2026-10-29 | CISA SSVC: total technical impact | No patch is stated; the vendor record directs customers to contact Progress Software Technical Support for guidance on available mitigations. | ||
| CVE-2026-116888 | NOISE | 26 | 7 | 25 | 65 | 5.4 | 4.0 | poc | poc_early | semantic-mediawiki, semanticmediawiki | semantic_mediawiki · semanticmediawiki | 2026-10-27 | CISA SSVC: public proof of concept | |||
| CVE-2026-116884 | NOISE | 26 | 7 | 25 | 65 | 6.1 | 5.1 | poc | poc_early | semantic-mediawiki, semanticmediawiki | semantic_mediawiki · semanticmediawiki | 2026-10-27 | CISA SSVC: public proof of concept | |||
| CVE-2026-116872 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 29.1 | poc | poc_early | semanticmediawiki | semanticmediawiki | 2026-10-27 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-116820 | NOISE | 26 | 19 | 25 | 40 | 5.3 | 14.0 | poc | poc_early | yeswiki | yeswiki | 2026-10-27 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-90991 | NOISE | 26 | 0 | 50 | 55 | 6.5 | 32.3 | none | none | langflow, ibm | langflow oss | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-107052 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 29.2 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-116623 | NOISE | 26 | 20 | 25 | 40 | 7.3 | 32.9 | poc | poc_early | code-projects | simple content management system | 2026-10-27 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-94380 | NOISE | 26 | 20 | 13 | 49 | 8.1 | none | none | havelsan inc. | liman mys | 2026-10-26 | CISA SSVC: total technical impact | ||||
| CVE-2026-115910 | NOISE | 26 | 15 | 25 | 50 | 6.8 | 4.8 | poc | poc_early | python-social-auth | social-core | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-118779 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 46.4 | poc | poc_early | digitalbazaar | forge | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-116605 | NOISE | 26 | 19 | 25 | 40 | 5.3 | 22.9 | poc | poc_early | sourcecodester | online food ordering system | 2026-10-27 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-116542 | NOISE | 26 | 19 | 25 | 40 | 5.3 | 11.0 | poc | poc_early | netty | netty-tcnative-boringssl-static | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-107037 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 37.7 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-116602 | NOISE | 26 | 19 | 25 | 40 | 6.5 | 40.6 | poc | poc_early | sourcecodester | online food ordering system | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-107026 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 39.7 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-115274 | NOISE | 26 | 19 | 25 | 40 | 6.9 | 42.7 | poc | poc_early | elixir-lang | elixir | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-104594 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 15.6 | poc | poc_early | n/a | n/a | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-116112 | NOISE | 26 | 20 | 25 | 40 | 7.3 | 17.0 | poc | poc_early | hashenudara | edoc-doctor-appointment-system | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-107042 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 29.2 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-118659 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 33.1 | poc | poc_early | capricorn86 | happy-dom | 2026-10-28 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-93857 | REVIEW | 26 | 19 | 25 | 40 | 9.2 | 46.4 | none | none | watchguard | fireware os | 2026-10-27 | Pre-auth, no-interaction stack buffer overflow in WatchGuard Fireware’s SIP proxy reachable from the internet, with remote code execution potential. No exploitation signal yet: EPSS 0.47%, no KEV, no public exploit or detection template. | Upgrade Fireware OS to 2026.4, 12.12.4, or 12.5.22 or later per the WatchGuard PSIRT advisory. Until upgraded, remove or restrict internet-facing policies that invoke the SIP proxy, and monitor those policies for anomalous traffic. | ||
| CVE-2026-107020 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 47.5 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-83594 | NOISE | 26 | 13 | 13 | 65 | 8.3 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | Upgrade to Apache Wicket 9.25.0 or 10.12.0, which fix the issue. | ||||
| CVE-2026-84170 | NOISE | 26 | 13 | 13 | 65 | 8.3 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | Upgrade to Apache Wicket 9.25.0 or 10.12.0, which fix the issue. | ||||
| CVE-2026-107044 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 5.9 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-107055 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 4.8 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-119284 | NOISE | 26 | 19 | 25 | 40 | 6.9 | 8.9 | poc | poc_early | authlib | joserfc | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-116678 | NOISE | 26 | 19 | 25 | 40 | 5.8 | 26.1 | poc | poc_early | dani-garcia | vaultwarden | 2026-10-27 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-115907 | NOISE | 26 | 20 | 25 | 40 | 7.5 | 28.7 | poc | poc_early | zip-rs | zip2 | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-97209 | NOISE | 26 | 15 | 25 | 50 | 5.4 | 1.5 | poc | poc_early | elixir-lang | elixir | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-61738 | NOISE | 26 | 11 | 18 | 65 | 10.0 | none | socfortress | copilot | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to CoPilot 0.1.77 or later, which removes caller-controlled filenames from the affected route. | ||||
| CVE-2026-61728 | NOISE | 26 | 11 | 18 | 65 | 9.9 | none | socfortress | copilot | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to CoPilot 0.1.76 or later, the first release containing all observed repairs; the health-check sink fix alone is contained starting from 0.1.70. | ||||
| CVE-2026-77059 | NOISE | 26 | 12 | 13 | 65 | 8.8 | none | none | boneio | boneio | 2026-10-26 | CISA SSVC: total technical impact | Upgrade boneIO to version 1.6.0 or later, which fixes the TOCTOU race in the timezone sudoers route. | |||
| CVE-2026-117512 | NOISE | 26 | 20 | 25 | 40 | 7.3 | 31.1 | poc | poc_early | oretnom23 | php-travel-agency-system | 2026-10-27 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-91915 | NOISE | 26 | 8 | 58 | 30 | 6.8 | none | none | dell | openmanage enterprise | 2026-10-30 | CISA SSVC: total technical impact | Upgrade Dell OpenManage Enterprise to version 4.8.0 or later, per Dell advisory DSA-2026-467. | |||
| CVE-2026-75882 | NOISE | 26 | 3 | 33 | 65 | 8.5 | none | none | eset spol. s.r.o. | eset endpoint encryption · eset full disk encryption | 2026-10-30 | CISA SSVC: total technical impact | Upgrade ESET Endpoint Encryption to 5.4.29.0 or later and ESET Full Disk Encryption to 2.4.8.0 or later; versions up to 5.4.23.0 and 2.4.4.0 respectively are affected. | |||
| CVE-2026-116238 | NOISE | 26 | 12 | 13 | 65 | 8.1 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade pgAdmin 4 to 9.19 or later, which refuses Flask-Security’s own views and counts every failed internal login. | ||||
| CVE-2026-110305 | NOISE | 25 | 13 | 25 | 50 | 7.5 | none | none | hwk-fr | advanced custom fields: extended | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-115190 | NOISE | 25 | 15 | 13 | 55 | 8.0 | none | none | affected product not stated | 2026-10-26 | CISA SSVC: total technical impact | No official workaround; restrict segment, custom field and API access to trusted users and ensure no untrusted party has write access to the Mautic database. | ||||
| CVE-2026-118660 | NOISE | 25 | 10 | 30 | 50 | 8.6 | 34.7 | none | none | capricorn86 | happy-dom | 2026-10-28 | CISA SSVC: automatable | Upgrade happy-dom to version 21.0.0 or later. | ||
| CVE-2026-111548 | NOISE | 25 | 0 | 58 | 40 | 5.3 | 28.0 | none | moxa | nport w2150a-w4/w2250a-w4 series | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-99100 | NOISE | 25 | 0 | 70 | 30 | 5.7 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76010 | NOISE | 25 | 9 | 33 | 50 | 8.8 | 66.4 | none | smub | photo gallery, sliders, proofing and themes – nextgen gallery | 2026-10-31 | no exploitation evidence in any monitored source | ||||
| CVE-2026-61708 | NOISE | 25 | 8 | 18 | 65 | 8.5 | none | none | socfortress | copilot | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to CoPilot 0.1.76 or later, which fixes the unrestricted upload write path. | |||
| CVE-2026-61850 | NOISE | 25 | 10 | 13 | 65 | 9.3 | none | akuity | kargo | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to Kargo 1.8.14, 1.9.9, or 1.10.8 or later. | ||||
| CVE-2026-99118 | NOISE | 25 | 0 | 70 | 30 | 6.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-90865 | NOISE | 25 | 12 | 25 | 50 | 9.0 | 66.7 | none | none | progress software | ws_ftp server | 2026-10-29 | CISA SSVC: total technical impact | No patch is stated; the vendor directs customers to contact Progress Software Technical Support for guidance on available mitigations. | ||
| CVE-2026-102905 | NOISE | 25 | 12 | 25 | 50 | 6.5 | none | none | spacetime | ad inserter – ad manager & adsense ads | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-62853 | NOISE | 25 | 11 | 13 | 65 | 9.9 | none | mqttsnet | thinglinks | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade ThingLinks to version 1.4.0 or later, which fixes the unsandboxed Groovy script compilation in the rule engine. | ||||
| CVE-2026-107091 | NOISE | 25 | 17 | 25 | 40 | 7.8 | 4.6 | poc | poc_early | n/a | n/a | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-115706 | NOISE | 25 | 3 | 63 | 30 | 6.8 | 17.5 | none | none | elastic | elastic_cloud_enterprise · elastic cloud enterprise | 2026-10-29 | CISA SSVC: total technical impact | Upgrade to ECE 3.8.6 or 4.2.1 (or a later release verified to contain the fix); no workarounds exist. | ||
| CVE-2026-105608 | NOISE | 25 | 12 | 13 | 61 | 8.8 | none | none | hashicorp | consul enterprise | 2026-10-26 | CISA SSVC: total technical impact | Upgrade to Consul Community Edition 2.1.0 or later, or Consul Enterprise 2.1.0 or 1.21.19 or later. | |||
| CVE-2026-99146 | NOISE | 25 | 0 | 70 | 30 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120322 | NOISE | 25 | 11 | 13 | 65 | 9.9 | none | termix-ssh | termix | 2026-11-02 | no exploitation evidence in any monitored source | Upgrade to core v26.10.0 or the standalone File Manager plugin v1.0.0, where the vulnerable shortcut was removed and transfers always use SFTP. | ||||
| CVE-2026-59177 | NOISE | 25 | 12 | 25 | 50 | 8.8 | 67.4 | nuclei | poc_early | esphome | device-builder | 2026-10-28 | public detection template exists (nuclei) | Upgrade ESPHome Device Builder to version 1.0.10 or later. | ||
| CVE-2026-120070 | NOISE | 25 | 9 | 33 | 50 | 8.8 | none | wedevs | user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submission | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119599 | NOISE | 25 | 12 | 25 | 50 | 4.3 | poc | poc_early | looplj | axonhub | 2026-10-30 | CISA SSVC: public proof of concept | ||||
| CVE-2026-115711 | NOISE | 25 | 3 | 63 | 30 | 6.4 | 12.8 | none | none | elastic | elastic_cloud_enterprise · elastic cloud enterprise | 2026-10-29 | CISA SSVC: total technical impact | Upgrade to ECE 3.8.6 or 4.2.1 (or a later release verified to contain the fix), then revoke unneeded persistent role tokens and prefer ephemeral tokens. | ||
| CVE-2026-106781 | NOISE | 25 | 17 | 25 | 40 | 7.8 | 13.4 | poc | poc_early | n/a | n/a | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-116241 | NOISE | 25 | 11 | 13 | 65 | 9.9 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade pgAdmin 4 to 9.19 or later, which rejects any backslash inside a double-quoted identifier. | ||||
| CVE-2026-119190 | NOISE | 24 | 16 | 25 | 40 | 7.4 | 15.9 | poc | poc_early | digitalbazaar | forge | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-120203 | NOISE | 24 | 9 | 13 | 65 | 8.8 | none | showdoc | showdoc | 2026-10-31 | no exploitation evidence in any monitored source | Upgrade ShowDoc to 3.9.6 or later; the fix is in commit 5a2087a3f408f5266f61e9e2fb98845ef4788288. | ||||
| CVE-2026-113387 | NOISE | 24 | 10 | 25 | 50 | 8.6 | 21.3 | none | none | canva | ortto | 2026-10-29 | CISA SSVC: automatable | Update the Ortto WordPress plugin to version 1.0.25 or later. | ||
| CVE-2026-61586 | NOISE | 24 | 12 | 0 | 70 | 8.2 | none | copernik-eu | copernik-xml-factory | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to Copernik XML Factory 0.1.2 or later, which blocks XInclude resource resolution on the stock JDK provider. | ||||
| CVE-2026-61854 | NOISE | 24 | 12 | 5 | 65 | 8.2 | none | jackh54 | voicesentinel | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to VoiceSentinel 3.3.1 or later, which fixes the report buffer race condition. | ||||
| CVE-2026-115830 | NOISE | 24 | 16 | 18 | 45 | 8.7 | none | none | delinea | secret server | 2026-10-30 | CISA SSVC: total technical impact | Upgrade to Secret Server version 12.3.1 or later; versions up to and including 12.2.7 are affected. | |||
| CVE-2026-63339 | NOISE | 24 | 9 | 13 | 65 | 8.8 | none | inex | ixp-manager | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to IXP Manager 7.3.0 or later, which fixes the privilege-escalation issue. | ||||
| CVE-2026-120276 | NOISE | 24 | 16 | 13 | 50 | 10.0 | none | wavlink | wn536ax6-a | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-47235 | NOISE | 24 | 16 | 25 | 40 | 7.5 | 4.4 | poc | poc_early | simulationcraft | simc | 2026-10-28 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-120189 | NOISE | 24 | 16 | 13 | 50 | 10.0 | none | d-link | dir-505 | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107017 | NOISE | 24 | 23 | 0 | 49 | 9.1 | 5.9 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-118086 | NOISE | 24 | 17 | 13 | 50 | 8.8 | none | none | hakan ozevin | wp base booking | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-120201 | NOISE | 24 | 16 | 13 | 50 | 9.8 | none | dromara | jpom | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107034 | NOISE | 24 | 23 | 0 | 50 | 9.1 | 6.9 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-116638 | NOISE | 24 | 20 | 25 | 30 | 7.5 | 11.3 | poc | poc_early | n/a | n/a | 2026-10-26 | CISA SSVC: public proof of concept; CISA SSVC: automatable | |||
| CVE-2026-116239 | NOISE | 24 | 8 | 13 | 65 | 8.5 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade pgAdmin 4 to 9.19 or later, which looks up the account by authenticated username and authenticating source. | ||||
| CVE-2026-116249 | NOISE | 24 | 8 | 13 | 65 | 8.4 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to pgAdmin 4 9.19 or later, which confines resolved paths (symlinks followed) to the user’s storage directory and accepts only exact libpq keywords as parameter names. | ||||
| CVE-2026-120209 | NOISE | 24 | 16 | 13 | 50 | 9.8 | none | anji-plus | aj-report | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119408 | NOISE | 24 | 9 | 13 | 65 | 8.8 | none | n8n-io | n8n | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to n8n 2.42.6 or later, 2.43.3 or later, or 3.0.1 or later. | ||||
| CVE-2026-62990 | NOISE | 24 | 8 | 13 | 65 | 8.7 | none | shopperlabs | shopper | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to 2.10.1 or later, or 3.0.0-beta.3 or later for the 3.x prerelease line. | ||||
| CVE-2026-112905 | NOISE | 24 | 9 | 13 | 65 | 9.0 | none | givanz | vvveb | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade Vvveb to version 1.0.8.7 or later, which patches the IDOR in the admin/auth-token endpoint. | ||||
| CVE-2026-120315 | NOISE | 24 | 9 | 13 | 65 | 8.8 | none | lobehub | chat | 2026-11-02 | no exploitation evidence in any monitored source | Upgrade LobeHub Chat to 2.1.49 or later; versions from 1.84.26 before 2.1.49 are affected. | ||||
| CVE-2026-120345 | NOISE | 24 | 16 | 13 | 50 | 10.0 | none | wavlink | wn551x3-a | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107028 | NOISE | 24 | 23 | 0 | 50 | 9.1 | 5.9 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept; CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-96894 | NOISE | 24 | 12 | 33 | 40 | 7.2 | none | none | wedevs | erp: complete hr, accounting & crm suite built for woocommerce | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-119709 | NOISE | 24 | 12 | 30 | 40 | 5.8 | none | none | goniszewski | grimoire | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-120198 | NOISE | 24 | 16 | 13 | 50 | 10.0 | none | wavlink | wl-wn530be1-a | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116512 | NOISE | 24 | 16 | 13 | 50 | 9.8 | none | wedevs | project manager – ai powered project management, task management, kanban board & time tracker | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-45144 | NOISE | 24 | 9 | 13 | 65 | 8.9 | none | chamilo | chamilo-lms | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to Chamilo LMS 2.0.1 or later; the fix is included in the v2.0.1 release. | ||||
| CVE-2026-119096 | NOISE | 24 | 16 | 13 | 50 | 9.8 | none | uncannyowl | uncanny toolkit for learndash | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120277 | NOISE | 24 | 16 | 13 | 50 | 10.0 | none | wavlink | wn536ax6-a | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-59387 | NOISE | 24 | 7 | 30 | 50 | 8.8 | 18.8 | none | none | cloud foundry | capi (cloud controller api) · cf-deployment | 2026-10-30 | CISA SSVC: total technical impact | Upgrade CAPI to v1.247.0 or later, or cf-deployment to 60.7.0 or later. | ||
| CVE-2026-119660 | NOISE | 24 | 16 | 0 | 65 | 9.8 | none | yincongcyincong | musebot | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade MuseBot to 2.0.0 or later, which removes the hard-coded default session key; patch commits 3e64518 and 139f615 are referenced. | ||||
| CVE-2026-120280 | NOISE | 24 | 16 | 13 | 50 | 10.0 | none | wavlink | wn536ax6-a | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117601 | NOISE | 24 | 16 | 25 | 40 | 7.5 | 7.1 | none | none | spesmilo | electrum | 2026-10-27 | CISA SSVC: automatable; CISA SSVC: total technical impact | |||
| CVE-2026-63338 | NOISE | 24 | 8 | 13 | 65 | 8.3 | none | inex | ixp-manager | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to IXP Manager 7.3.0 or later, which fixes the missing ownership check in ApiKeyController. | ||||
| CVE-2026-76058 | NOISE | 24 | 7 | 33 | 50 | 5.3 | 17.8 | none | none | odefranca | paypal brasil para woocommerce | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-62849 | NOISE | 24 | 26 | 13 | 30 | 9.1 | none | none | mqttsnet | thinglinks | 2026-10-30 | CISA SSVC: automatable | Upgrade ThingLinks to version 1.4.0 or later. | |||
| CVE-2026-120279 | NOISE | 24 | 16 | 13 | 50 | 10.0 | none | wavlink | wn536ax6-a | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-63393 | NOISE | 24 | 8 | 13 | 65 | 8.7 | none | opensearch-project | sql | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade the OpenSearch SQL plugin to 2.19.6.0 or 3.7.0.0 or later. | ||||
| CVE-2026-59107 | NOISE | 24 | 16 | 13 | 50 | 9.8 | none | wolfvision | cynap pro, cynap core pro · cynap, cynap core | 2026-10-26 | no exploitation evidence in any monitored source | No patch is stated; until an update is available, disable vSolution Matrix file sharing if not required and restrict TCP port 50930 to trusted hosts. | ||||
| CVE-2026-89209 | NOISE | 24 | 3 | 50 | 40 | 6.8 | 17.7 | none | none | siemens | mendix saml (mendix 10 compatible) · mendix saml (mendix 11 compatible) · mendix saml (mendix 9 compatible) | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-120281 | NOISE | 24 | 16 | 13 | 50 | 10.0 | none | wavlink | wn536ax6-a | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-78527 | NOISE | 24 | 17 | 13 | 50 | 8.8 | none | none | gs plugins | gs testimonial slider | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-116247 | NOISE | 23 | 7 | 13 | 65 | 8.2 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to pgAdmin 4 9.19 or later, which sets each of these parameters explicitly in server mode (user’s own file or an unopenable path) in the connection string, utility environment and –dbname string. | ||||
| CVE-2026-115829 | NOISE | 23 | 16 | 13 | 45 | 8.7 | none | none | delinea | secret server | 2026-10-30 | CISA SSVC: total technical impact | Upgrade to Secret Server version 12.3.1 or later. | |||
| CVE-2026-33521 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | esri | arcgis server | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-72754 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | nlnet labs | routinator | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-101213 | NOISE | 23 | 2 | 58 | 30 | 7.8 | none | none | dell | openmanage enterprise | 2026-10-30 | CISA SSVC: total technical impact | Upgrade Dell OpenManage Enterprise to version 4.8.0 or later, per Dell advisory DSA-2026-467. | |||
| CVE-2026-15323 | NOISE | 23 | 13 | 25 | 40 | 7.5 | 58.5 | none | none | king-theme | product designer for woocommerce wordpress | lumise | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-116401 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | realmag777 | husky | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-57201 | NOISE | 23 | 13 | 25 | 40 | 7.5 | 53.2 | none | none | asterisk | certified-asterisk | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-57200 | NOISE | 23 | 9 | 25 | 50 | 7.5 | 59.1 | none | none | asterisk, certified-asterisk | certified-asterisk | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-107630 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | saadiqbal | email templates customizer and designer for wordpress and woocommerce | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-118758 | NOISE | 23 | 8 | 25 | 50 | 7.5 | 44.5 | none | none | kubeflow | pipelines | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-72756 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | nlnet labs | routinator | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-119290 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | zuke-build | zuke | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-63396 | NOISE | 23 | 13 | 0 | 65 | 8.7 | none | roostorg | coop | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade Coop to version 1.0.0 or later; running the service on an authenticated private network is a mitigation only. | ||||
| CVE-2026-105626 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | hashicorp | consul enterprise | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-119762 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | axigen | axigen mail server | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-116862 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | acato | wp rest cache | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-39734 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | saad iqbal | wp easypay | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-97638 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | wpmudev | forminator forms – contact form, payment form & custom form builder | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-72758 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | nlnet labs | routinator | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-116244 | NOISE | 23 | 7 | 13 | 65 | 8.2 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to pgAdmin 4 9.19 or later, which pins KRB5CCNAME/KRB5_CLIENT_KTNAME and enforces require_auth=!gss,!sspi with gssencmode=disable on non-Kerberos connections (require_auth needs libpq 16+). | ||||
| CVE-2026-116242 | NOISE | 23 | 7 | 13 | 65 | 8.2 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to pgAdmin 4 9.19 or later, which limits server-mode SSH tunnels to the user’s own configured identity file or password. | ||||
| CVE-2026-66088 | NOISE | 23 | 13 | 25 | 40 | 9.4 | 52.6 | none | none | apereo foundation | openequella | 2026-10-29 | CISA SSVC: total technical impact | Upgrade openEQUELLA to 2026.1 or later; versions before 2026.1 are affected. | ||
| CVE-2026-93904 | NOISE | 23 | 8 | 25 | 50 | 7.5 | 39.7 | none | none | dejanmarkovic | social web suite – social media auto post, social media auto publish | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-106079 | NOISE | 23 | 4 | 33 | 50 | 8.8 | 67.7 | none | juniper networks | session smart router · session smart conductor | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to Session Smart Router or Conductor 7.0.5, 7.1.7, 7.2.3 or later; no workarounds are available. | |||
| CVE-2026-116891 | NOISE | 23 | 0 | 25 | 65 | 6.1 | 6.8 | none | semantic-mediawiki, semanticmediawiki | semantic_mediawiki · semanticmediawiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116875 | NOISE | 23 | 0 | 25 | 65 | 6.1 | 6.8 | none | semantic-mediawiki, semanticmediawiki | semantic_mediawiki · semanticmediawiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111459 | NOISE | 23 | 0 | 50 | 40 | 7.6 | 6.7 | none | moxa | moxa remote connect suite (mrc client) | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111461 | NOISE | 23 | 1 | 50 | 40 | 7.5 | 71.9 | none | moxa | oncell g3150a-lte series | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115713 | NOISE | 23 | 0 | 63 | 30 | 7.5 | 4.8 | none | none | elastic | elastic_cloud_enterprise · elastic cloud enterprise | 2026-10-29 | CISA SSVC: total technical impact | Upgrade to Elastic Cloud Enterprise 4.2.1 or later; versions 4.1.0 through 4.2.0 are affected and no workarounds exist. | ||
| CVE-2026-115708 | NOISE | 23 | 0 | 63 | 30 | 7.2 | 7.1 | none | none | elastic | elastic_cloud_enterprise · elastic cloud enterprise | 2026-10-29 | CISA SSVC: total technical impact | Upgrade to ECE 3.8.6 or 4.2.1 (or a later release verified to contain the fix); no workarounds exist for users who cannot upgrade. | ||
| CVE-2026-115905 | NOISE | 23 | 6 | 13 | 65 | 10.0 | none | zip-rs | zip2 | 2026-10-26 | no exploitation evidence in any monitored source | Upgrade zip2 to version 9.0.5 or later, which fixes the Local File Header versus Central Directory mismatch in src/read/stream.rs. | ||||
| CVE-2014-125135 | NOISE | 23 | 13 | 25 | 40 | 7.3 | none | none | n/a | octoprint | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-115909 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | zip-rs | zip2 | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-116368 | NOISE | 23 | 13 | 25 | 40 | 7.3 | none | none | deepseek | harness | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-119116 | NOISE | 23 | 10 | 30 | 40 | 7.8 | none | none | aws | kmstool-enclave | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-116861 | NOISE | 23 | 13 | 25 | 40 | 7.5 | none | none | wpdesk | flexible chat | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-119145 | NOISE | 23 | 14 | 25 | 40 | 9.9 | 55.3 | none | none | frappe | frappe | 2026-10-29 | CISA SSVC: total technical impact | Upgrade to Frappe 15.121.0 or later, or 16.34.0 or later. | ||
| CVE-2026-109218 | NOISE | 23 | 14 | 25 | 40 | 9.8 | 50.8 | none | none | kleor | contact manager | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-63182 | NOISE | 23 | 7 | 13 | 65 | 8.1 | none | litesaml | lightsaml | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to LightSAML 4.7.1 or later, or 5.0.1 or later for the 5.x line. | ||||
| CVE-2026-115709 | NOISE | 23 | 0 | 63 | 30 | 8.2 | 17.1 | none | none | elastic | elastic_cloud_enterprise · elastic cloud enterprise | 2026-10-29 | CISA SSVC: total technical impact | Upgrade to ECE 3.8.6 or 4.2.1 (or a later release verified to contain the fix); no workarounds exist. | ||
| CVE-2026-117666 | NOISE | 23 | 14 | 13 | 50 | 9.1 | none | deadtrickster | ssl_verify_fun | 2026-10-30 | no exploitation evidence in any monitored source | No patched release is stated; on Erlang/OTP 21+ keep server_name_indication set and pass {customize_hostname_check, [{match_fun, public_key:pkix_verify_hostname_match_fun(https)}]} in the ssl options so ssl rejects the m | ||||
| CVE-2026-62989 | NOISE | 23 | 7 | 13 | 65 | 8.1 | none | shopperlabs | shopper | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to Shopper 2.10.0 or later, which adds server-side authorization to the Variants delete and bulk-delete actions. | ||||
| CVE-2026-62967 | NOISE | 23 | 7 | 13 | 65 | 8.1 | none | sinamics | ztnet | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to ZTNET 0.8.0 or later, which fixes the missing authorization check in invalidateUser. | ||||
| CVE-2026-116889 | NOISE | 23 | 0 | 25 | 65 | 6.1 | 5.1 | none | semantic-mediawiki, semanticmediawiki | semantic_mediawiki · semanticmediawiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111460 | NOISE | 23 | 0 | 50 | 40 | 7.7 | 22.9 | none | moxa | oncell g3150a-lte series | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-33924 | NOISE | 23 | 8 | 25 | 50 | 7.2 | 66.0 | none | none | nozomi networks | guardian · cmc | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-118638 | NOISE | 23 | 8 | 25 | 50 | 7.5 | 3.9 | none | none | unknown | mapster wp maps | 2026-10-31 | CISA SSVC: automatable | |||
| CVE-2026-118769 | REVIEW | 23 | 7 | 13 | 65 | 9.2 | 30.3 | none | none | randombit | botan | 2026-10-29 | Pre-auth, no-user-interaction memory corruption (CVSS 9.2) in Botan’s C FFI, but exploitation requires an application that passes attacker-controlled algorithm strings into raw ECB mode – a narrow, non-default configuration. No public exploit or detection template exists and EPSS is 0.37%. | Upgrade Botan to 3.13.0 or later and restart dependent services. If upgrade is delayed, stop passing externally supplied algorithm parameter strings into the FFI raw ECB mode, or restrict to fixed cipher selections. | ||
| CVE-2026-94361 | NOISE | 22 | 7 | 33 | 40 | 5.3 | 3.9 | none | none | unknown | payable payment gateway for woocommerce | 2026-10-31 | CISA SSVC: automatable | |||
| CVE-2026-116860 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | arraytics | timetics | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-33522 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | esri | arcgis server | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-115917 | NOISE | 22 | 0 | 21 | 65 | 4.7 | 15.2 | none | none | vllm, vllm-project | vllm | 2026-10-26 | no exploitation evidence in any monitored source | Upgrade to vLLM 0.32.0 or later, which no longer defaults the CORS allowed_origins to a wildcard. | ||
| CVE-2026-110377 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | villatheme | bopo – woocommerce product bundle builder | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-62162 | NOISE | 22 | 12 | 0 | 65 | 8.2 | none | none | cardano-scaling | hydra | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade Hydra to version 2.1.0 or later, which fixes the missing invariant in the deposit validator. | |||
| CVE-2026-78674 | NOISE | 22 | 12 | 25 | 40 | 8.8 | 62.7 | none | none | wso2 | enterprise integrator (bps profile) · business process server | 2026-10-28 | CISA SSVC: total technical impact | Apply the fix per WSO2 security advisory WSO2-2026-5692 (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5692/#solution). | ||
| CVE-2026-103319 | NOISE | 22 | 7 | 33 | 40 | 5.3 | 3.1 | none | none | unknown | opay payment gateway for woocommerce | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-103306 | NOISE | 22 | 7 | 33 | 40 | 5.3 | 3.1 | none | none | unknown | online payments with ik pay gateway | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-103298 | NOISE | 22 | 7 | 33 | 40 | 5.3 | 3.1 | none | none | unknown | ccavenue payment gateway for woocommerce | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-114216 | NOISE | 22 | 12 | 25 | 40 | 6.3 | none | none | mtrudel | bandit | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-103359 | NOISE | 22 | 7 | 33 | 40 | 5.3 | 1.5 | none | none | unknown | paydunya woocommerce payment gateway | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-116797 | NOISE | 22 | 6 | 25 | 50 | 8.5 | 24.5 | none | none | highcharts, @highcharts | highcharts · grid-pro · dashboards | 2026-10-28 | CISA SSVC: total technical impact | Upgrade Highcharts Grid Pro to 3.2.0 or later; the flaw affects versions from 2.0.0 until 3.2.0. | ||
| CVE-2026-103390 | NOISE | 22 | 7 | 33 | 40 | 5.3 | 37.5 | none | none | juniper networks | session smart router · session smart conductor | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2013-10077 | NOISE | 22 | 7 | 25 | 50 | 5.3 | 37.6 | none | none | n/a | octoprint | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-115679 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | keil | mdk-middleware | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-116217 | NOISE | 22 | 12 | 25 | 40 | 6.1 | none | none | francoisjacquet | rosariosis | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-119186 | NOISE | 22 | 7 | 25 | 50 | 5.9 | 10.7 | poc | poc_early | digitalbazaar | forge | 2026-10-29 | CISA SSVC: public proof of concept | |||
| CVE-2026-113438 | NOISE | 22 | 7 | 25 | 50 | 6.9 | 14.8 | none | none | implem inc. | pleasanter | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-92086 | NOISE | 22 | 7 | 25 | 50 | 5.3 | 27.0 | none | none | websoudan | mw wp form | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-115964 | REVIEW | 22 | 12 | 25 | 40 | 9.3 | 25.4 | none | none | stylemixthemes | motors | 2026-10-29 | CISA SSVC: automatable; floor: pre-auth, no-user-interaction CVSS 9.3 with a fix available is never below REVIEW | Update the WordPress Motors plugin to version 1.4.127 or later. | ||
| CVE-2026-110691 | NOISE | 22 | 7 | 25 | 50 | 6.5 | 17.9 | none | none | unknown | wporlogin | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-116282 | NOISE | 22 | 12 | 25 | 40 | 4.3 | none | none | n/a | kameleo | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-107868 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | yithemes | yith woocommerce product add-ons | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-116672 | NOISE | 22 | 7 | 25 | 50 | 8.8 | 19.8 | none | none | authlib | authlib | 2026-10-27 | CISA SSVC: total technical impact | Upgrade Authlib to version 1.9.1 or later, which fixes the client authentication and permission checks. | ||
| CVE-2026-7005 | NOISE | 22 | 12 | 25 | 40 | 6.1 | poc | poc_early | wit | synapps runtime | 2026-10-30 | CISA SSVC: public proof of concept | ||||
| CVE-2026-119658 | NOISE | 22 | 12 | 25 | 40 | 4.3 | poc | poc_early | powerdns-admin | powerdns-admin | 2026-10-30 | CISA SSVC: public proof of concept | ||||
| CVE-2026-116102 | NOISE | 22 | 12 | 25 | 40 | 6.3 | 59.7 | none | none | quantgeekdev | docker-mcp | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-119714 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | joedolson | my calendar – accessible event manager | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-103898 | NOISE | 22 | 12 | 13 | 50 | 8.1 | none | roxnor | wp social login and register social counter | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118100 | NOISE | 22 | 7 | 25 | 50 | 5.3 | 3.8 | none | none | unknown | buddyforms | 2026-10-30 | CISA SSVC: automatable | |||
| CVE-2026-116818 | NOISE | 22 | 9 | 30 | 40 | 8.2 | 37.2 | none | none | openpanel-dev | openpanel | 2026-10-27 | CISA SSVC: automatable | Upgrade to OpenPanel 3.0.0 or later, which is unaffected; the fix is in commit 35ddc8e. | ||
| CVE-2026-61845 | NOISE | 22 | 4 | 13 | 65 | 8.9 | none | none | rgrove | crass | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade Crass to version 1.0.7 or later. | |||
| CVE-2026-62979 | NOISE | 22 | 8 | 5 | 65 | 8.4 | none | none | roziscoding | jack | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to jack 0.1.0 or later, which fixes the error-handling path that leaks internal API keys and connector secrets. | |||
| CVE-2026-115598 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | thimpress | learnpress | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-115959 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | wpexperts | apiexperts square for woocommerce | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-103313 | NOISE | 22 | 7 | 33 | 40 | 5.3 | 5.4 | none | none | unknown | bitpay gateway for woocommerce | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-62056 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | wp manageninja llc | fluent crm | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-119701 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | wpgraphql | wpgraphql | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-119702 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | wpgraphql | wpgraphql | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-62122 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | arraytics | booktics | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-72757 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | nlnet labs | routinator | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-115595 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | supsystic | contact form by supsystic | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-119710 | NOISE | 22 | 12 | 25 | 40 | 7.1 | poc | poc_early | pipeshub-ai | pipeshub-ai | 2026-10-30 | CISA SSVC: public proof of concept | ||||
| CVE-2026-119646 | NOISE | 22 | 12 | 25 | 40 | 4.3 | poc | poc_early | open web analytics | open web analytics | 2026-10-30 | CISA SSVC: public proof of concept | ||||
| CVE-2026-119705 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | towfiqi | serpbear | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-118245 | NOISE | 22 | 6 | 25 | 50 | 8.6 | 27.2 | none | none | highcharts, @highcharts | highcharts · dashboards | 2026-10-28 | CISA SSVC: total technical impact | Upgrade @highcharts/dashboards to 4.2.3 or later (the 4.2.2 release tag is referenced, but the affected range runs to below 4.2.3); Highcharts itself is fixed in 13.1.0 or later. | ||
| CVE-2026-116118 | NOISE | 22 | 12 | 25 | 40 | 6.3 | 64.3 | poc | poc_early | z.ai | zcode | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-116115 | NOISE | 22 | 7 | 25 | 50 | 3.1 | 18.1 | poc | poc_early | yoosee | gm8135s camera | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-59164 | NOISE | 22 | 7 | 25 | 50 | 7.1 | 9.8 | poc | poc_early | getnora-io | nora | 2026-10-28 | CISA SSVC: public proof of concept | |||
| CVE-2026-115614 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | magepeople inc. | booking and rental manager | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-109384 | NOISE | 22 | 12 | 25 | 40 | 8.8 | 54.1 | none | none | melograno | the innovative form builder – ivyforms | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-103410 | NOISE | 22 | 8 | 33 | 40 | 7.5 | 25.2 | none | none | juniper networks | session smart router | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-114278 | REVIEW | 22 | 6 | 25 | 50 | 9.8 | 59.6 | none | eclipse foundation | eclipse che | 2026-10-28 | floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Upgrade Eclipse Che above 7.122.0; the fix is in the che-machine-exec commit a78541c29e5f48fd59a49cf206bc0e507628bd23. | |||
| CVE-2026-116692 | REVIEW | 22 | 6 | 25 | 50 | 9.8 | 53.3 | none | mlflow | mlflow | 2026-10-27 | Unauthenticated remote code execution in MLflow’s scorer invoke endpoint when authentication is disabled, but exploitation requires the allowed scorer package to be writable by the server process and no public exploit or KEV listing exists. | Upgrade MLflow to 3.17.0 or later. Until then, enable authentication on MLflow deployments, restrict the /ajax-api/3.0/mlflow/scorer/invoke endpoint to trusted networks, and ensure the allowed scorer package directory is not writable by the server process. | |||
| CVE-2026-103594 | REVIEW | 22 | 0 | 38 | 50 | 9.5 | 37.5 | none | watchguard | fireware os | 2026-10-27 | Pre-auth, no-user-interaction buffer overflow in Fireware OS WireGuard config handling, but exploitation requires a man-in-the-middle position on the TLS-decrypted Firebox-to-WatchGuard-Cloud path, so it is not remotely reachable by an arbitrary internet attacker. | Upgrade Fireware OS to 2026.4 or 12.12.4; versions below these are affected. Until the upgrade window, restrict management and cloud connectivity to trusted paths and monitor Firebox-to-WatchGuard-Cloud traffic for tampering. | |||
| CVE-2026-116467 | NOISE | 22 | 12 | 25 | 40 | 5.3 | 50.6 | none | none | ggml-org | llama.cpp | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-103299 | NOISE | 22 | 7 | 33 | 40 | 5.3 | 3.1 | none | none | unknown | payment gateway | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-97255 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | wproyal | royal elementor addons | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-116410 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | masteriyo | masteriyo – lms | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-103300 | NOISE | 22 | 7 | 33 | 40 | 5.3 | 1.5 | none | none | unknown | eurobank woocommerce payment gateway | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-106003 | NOISE | 22 | 7 | 25 | 50 | 5.3 | 19.0 | none | none | unknown | court reservation | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-57193 | NOISE | 22 | 12 | 25 | 40 | 6.9 | 80.3 | none | none | asterisk | certified-asterisk | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-116554 | NOISE | 22 | 7 | 25 | 50 | 3.5 | 16.8 | poc | poc_early | n/a | argilla | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-103332 | NOISE | 22 | 7 | 33 | 40 | 5.3 | 7.1 | none | none | unknown | payex payment gateway for woocommerce | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-118252 | NOISE | 22 | 6 | 25 | 50 | 8.4 | 36.2 | none | none | highcharts, @highcharts | highcharts · dashboards | 2026-10-28 | CISA SSVC: total technical impact | Upgrade @highcharts/dashboards to 4.2.3 or later, which fixes the edit-mode sidebar HTML injection. | ||
| CVE-2026-112365 | NOISE | 22 | 12 | 25 | 40 | 7.2 | none | none | wpdevteam | easy.jobs – ai powered job listing, job board, career page, recruitment & hiring solution | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-111422 | NOISE | 22 | 12 | 25 | 40 | 8.8 | 50.8 | none | none | apache software foundation | apache airflow ssh provider | 2026-10-27 | CISA SSVC: total technical impact | Upgrade apache-airflow-providers-ssh to 7.0.1 or later. | ||
| CVE-2026-116388 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | tms | amelia | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-90866 | NOISE | 22 | 12 | 25 | 40 | 9.1 | 54.2 | none | none | progress software | ws_ftp server | 2026-10-29 | CISA SSVC: total technical impact | No patch is stated; limit Host Administrator delegation to trusted staff and audit virtual folder physical paths to confirm they stay within the assigned host root, or contact Progress support for mitigation guidance. | ||
| CVE-2026-90863 | NOISE | 22 | 12 | 25 | 40 | 9.1 | 51.4 | none | none | progress software | ws_ftp server | 2026-10-29 | CISA SSVC: total technical impact | No patch is stated; limit Host Administrator delegation to trusted staff, review existing Host Administrator accounts and their scope, and contact Progress support for mitigation guidance. | ||
| CVE-2026-90465 | REVIEW | 22 | 8 | 33 | 40 | 9.4 | 14.7 | none | none | watchguard | fireware os | 2026-10-27 | Pre-auth, no-interaction flaw lets anyone on the FireCluster interconnect run privileged management actions as root; the attack path is the cluster sync channel, not the public internet, so exposure is limited to adjacent attackers or a compromised peer. | Upgrade Fireware OS to 2026.4, 12.12.4, or 12.5.22 or later per the WatchGuard PSIRT advisory. Until then, restrict the cluster interconnect to trusted peers and segment it from general network traffic. | ||
| CVE-2026-116385 | NOISE | 22 | 12 | 25 | 40 | 3.5 | poc | poc_early | bdtask | garage 24 garage management software | 2026-10-26 | CISA SSVC: public proof of concept | ||||
| CVE-2026-119479 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | crocoblock | jetformbuilder | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-119368 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | liquid web / stellarwp | the events calendar | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-116853 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | nexcess | givewp | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-115678 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | keil | mdk-middleware | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-115607 | REVIEW | 22 | 12 | 25 | 40 | 9.3 | 14.7 | none | none | crowd favorite | dxp toolkit | 2026-10-28 | Unauthenticated SQL injection in a WordPress plugin with a CVSS of 9.3, but exploitation is unconfirmed (EPSS 0.0024, no KEV, no public exploit code) and the plugin is niche. | Update the DXP ToolKit plugin to version 2.0.2 or later, then restart the service. If you cannot patch promptly, restrict access to the affected plugin path or place the site behind a WAF. | ||
| CVE-2026-119482 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | crocoblock | jetformbuilder | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-120007 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | nodebb | nodebb | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-115821 | NOISE | 22 | 7 | 25 | 50 | 7.2 | 22.9 | none | none | newsmanapp | newsmanapp | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-118477 | REVIEW | 22 | 6 | 25 | 50 | 9.8 | 66.0 | none | eisge | kalifast | 2026-10-28 | floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Upgrade KaliFast to version 2026061802 or later. | |||
| CVE-2026-118635 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | paoltaia | geodirectory – wp business directory plugin and classified listings directory | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-111411 | REVIEW | 22 | 12 | 25 | 40 | 9.3 | 27.7 | none | none | aman | funnelkit automations | 2026-10-28 | CISA SSVC: automatable; floor: pre-auth, no-user-interaction CVSS 9.3 with a fix available is never below REVIEW | Update the FunnelKit Automations plugin to version 3.8.6 or later. | ||
| CVE-2026-116371 | NOISE | 22 | 12 | 25 | 40 | 6.3 | none | none | akuvox | akubela hypanel ps51 | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-116108 | NOISE | 22 | 7 | 25 | 50 | 4.3 | 17.5 | none | none | openbq-org | openbb | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-112352 | REVIEW | 22 | 12 | 25 | 40 | 9.1 | 70.8 | none | none | sunhillo corporation | sureline | 2026-10-27 | Unauthenticated attackers can forge a session cookie from a guessed username and chain it to root command execution, but no exploitation has been observed and the product is rare in most estates. | Upgrade Sunhillo SureLine to 9.1.5 or later; all earlier versions are affected. Until the upgrade is scheduled, restrict web management access to trusted networks and change default account names. | ||
| CVE-2026-93011 | NOISE | 22 | 12 | 25 | 40 | 5.3 | none | none | red hat | red hat ceph storage 9 · red hat enterprise linux 10 · red hat enterprise linux 6 +7 more | 2026-10-29 | CISA SSVC: automatable | ||||
| CVE-2026-115947 | NOISE | 22 | 12 | 25 | 40 | 6.5 | none | none | realmag777 | husky | 2026-10-30 | CISA SSVC: automatable | ||||
| CVE-2026-119299 | NOISE | 22 | 12 | 25 | 40 | 5.9 | poc | poc_early | gopacket | gopacket | 2026-10-30 | CISA SSVC: public proof of concept | ||||
| CVE-2026-116259 | NOISE | 22 | 12 | 25 | 40 | 5.3 | poc | poc_early | n/a | libimobiledevice | 2026-10-26 | CISA SSVC: public proof of concept | ||||
| CVE-2026-116262 | NOISE | 22 | 12 | 25 | 40 | 5.4 | poc | poc_early | n/a | libimobiledevice | 2026-10-26 | CISA SSVC: public proof of concept | ||||
| CVE-2026-103331 | NOISE | 22 | 7 | 33 | 40 | 5.3 | 14.0 | none | none | unknown | unipay payment gateway for woocommerce | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-100105 | NOISE | 21 | 0 | 33 | 50 | 7.7 | 21.6 | none | grafana | grafana enterprise · grafana oss | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111578 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | unknown | pdf invoices & packing slips for woocommerce | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-119586 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | sqlite | sqlite | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-9535 | NOISE | 21 | 9 | 25 | 40 | 8.2 | 17.5 | none | none | vtk | vtk | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-119379 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | sqlite | sqlite | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-120344 | NOISE | 21 | 11 | 13 | 50 | 10.0 | none | wavlink | wn551x3-a | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-89216 | NOISE | 21 | 10 | 25 | 40 | 8.6 | 19.8 | none | none | unknown | vtables | 2026-10-29 | CISA SSVC: automatable | Upgrade the vTables WordPress plugin to version 0.3 or later. | ||
| CVE-2026-116370 | NOISE | 21 | 10 | 13 | 50 | 9.6 | 34.0 | none | 2k, 2k games | sid_meiers_civilization_vi 1.0.12.68 · sid meier’s civilization vi | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-91153 | NOISE | 21 | 7 | 30 | 40 | 5.3 | 49.4 | none | none | wpeverest | everest forms – contact form, payment form, quiz, survey & custom form builder with ai | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-102212 | NOISE | 21 | 13 | 13 | 45 | 8.4 | none | opengear | im7200 · cm7100 · acm7000 | 2026-10-31 | no exploitation evidence in any monitored source | Upgrade to Opengear firmware 5.5.3 or later, which the vendor release notification lists as generally available and which supersedes the affected 4.8.0 through 5.5.2 range. | ||||
| CVE-2026-114444 | NOISE | 21 | 0 | 33 | 50 | 4.4 | 6.4 | none | none | unknown | security plugin, firewall & malware scanner with auto removal | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-85749 | NOISE | 21 | 9 | 25 | 40 | 8.1 | 21.3 | poc | poc_early | mailwatch | mailwatch | 2026-10-28 | CISA SSVC: public proof of concept | Upgrade to MailWatch 1.2.27 or later, which fixes the missing ownership check in quarantine_action.php. | ||
| CVE-2026-120238 | NOISE | 21 | 11 | 13 | 50 | 9.9 | none | wavlink | wn553x1-b | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114422 | NOISE | 21 | 9 | 25 | 40 | 7.5 | 57.2 | none | none | unknown | enable media replace | 2026-10-30 | CISA SSVC: total technical impact | |||
| CVE-2026-13303 | NOISE | 21 | 6 | 30 | 40 | 8.7 | 12.8 | none | none | hashicorp | boundary enterprise | 2026-10-29 | CISA SSVC: total technical impact | Upgrade to Boundary Enterprise 1.0.2 or 0.21.6, which fix CVE-2026-13303. | ||
| CVE-2026-3583 | NOISE | 21 | 0 | 33 | 50 | 3.1 | 18.3 | none | none | wso2 | wso2 api manager · wso2 traffic manager · wso2 universal gateway +5 more | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-113617 | NOISE | 21 | 9 | 25 | 40 | 9.9 | 28.0 | none | none | unknown | automated import products to cart | 2026-10-29 | CISA SSVC: total technical impact | Update the Automated Import Products to Cart plugin to 1.0.4 or later. | ||
| CVE-2026-119528 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-111255 | NOISE | 21 | 4 | 25 | 50 | 7.5 | 43.9 | none | none | cservit | affiliate-toolkit – multi-network affiliate & amazon product display | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-22109 | NOISE | 21 | 3 | 13 | 65 | 8.4 | none | none | delta electronics | delta ufc500 | 2026-10-30 | no exploitation evidence in any monitored source | Update the WebUI to version 1.4.7 or later; as a mitigation, change each account’s default password to a unique, non-default value. | |||
| CVE-2026-62847 | NOISE | 21 | 2 | 13 | 65 | 8.2 | none | none | metalama | metalama | 2026-10-30 | CISA SSVC: total technical impact | Upgrade to Metalama 2025.1.18, 2026.0.25 or 2026.1.19 or later. | |||
| CVE-2026-45145 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | chamilo | chamilo-lms | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-120231 | NOISE | 21 | 11 | 13 | 50 | 9.9 | none | wavlink | wn553x1-b | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111419 | NOISE | 21 | 10 | 25 | 40 | 8.6 | 28.1 | none | none | foxit software inc. | foxit.com | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-120196 | NOISE | 21 | 11 | 13 | 50 | 9.9 | none | wavlink | wn579x3-d | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-97860 | NOISE | 21 | 6 | 33 | 40 | 8.4 | 8.9 | none | none | yamaha corporation | yms-vpn8-cp | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-116589 | NOISE | 21 | 9 | 25 | 40 | 8.2 | 25.9 | none | none | datadog | dd-trace-py | 2026-10-26 | CISA SSVC: automatable | Upgrade dd-trace-py to version 4.15.5 or later. | ||
| CVE-2026-119717 | NOISE | 21 | 10 | 13 | 50 | 8.1 | none | none | up9inc | pybars4 | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-117560 | NOISE | 21 | 10 | 25 | 40 | 7.8 | 51.3 | none | none | atxp | gemini-cli-extension | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-57202 | NOISE | 21 | 5 | 25 | 50 | 8.1 | 38.2 | none | none | asterisk | certified-asterisk | 2026-10-27 | CISA SSVC: total technical impact | Upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, or Certified Asterisk 20.7-cert11 or 22.8-cert3. | ||
| CVE-2026-76012 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | smub | photo gallery, sliders, proofing and themes – nextgen gallery | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-77052 | NOISE | 21 | 3 | 13 | 65 | 8.7 | none | boneio | boneio | 2026-10-26 | no exploitation evidence in any monitored source | Upgrade boneIO to version 1.6.0 or later, which fixes the unauthenticated Node-RED exposure. | ||||
| CVE-2026-58412 | NOISE | 21 | 7 | 0 | 70 | 8.2 | none | filecoin-project | filecoin-pin | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to filecoin-pin 1.1.0 or later; the 0.x action line will not be backported and must be migrated to a fixed 1.x release. | ||||
| CVE-2026-119568 | NOISE | 21 | 9 | 25 | 40 | 7.4 | none | none | vsftpd | vsftpd | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-109822 | NOISE | 21 | 0 | 33 | 50 | 6.5 | 23.8 | none | none | yamaha corporation | nwr100 | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-115193 | NOISE | 21 | 7 | 13 | 55 | 8.2 | none | none | affected product not stated | 2026-10-26 | no exploitation evidence in any monitored source | No official workaround; restrict contact create/edit permissions and API access to trusted users, and avoid mapping public form fields to HTML-type contact fields. | ||||
| CVE-2026-61707 | NOISE | 21 | 7 | 30 | 40 | 9.0 | 14.4 | none | none | socfortress | copilot | 2026-10-29 | CISA SSVC: total technical impact | Upgrade CoPilot to version 0.1.76 or later, which fixes the template upload and rendering issue. | ||
| CVE-2026-104066 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | scribus | scribus | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-104067 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | scribus | scribus | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-119287 | NOISE | 21 | 0 | 13 | 70 | 8.0 | none | zuke-build | zuke | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade @zuke/core to version 1.51.0 or later, which applies the ZUKE_REGISTRY_LAUNCH_HOSTS authorization to command-form registry descriptors. | ||||
| CVE-2026-110042 | NOISE | 21 | 0 | 33 | 50 | 4.9 | 4.2 | none | none | unknown | payment forms for paystack | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-104062 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | scribus | scribus | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-118205 | NOISE | 21 | 9 | 25 | 40 | 7.4 | none | none | wpdevteam | essential addons for elementor – popular elementor templates & widgets | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-110720 | NOISE | 21 | 9 | 25 | 40 | 9.9 | 30.3 | none | none | hashicorp | tooling | 2026-10-26 | CISA SSVC: total technical impact | Upgrade consul-k8s to 2.1.0 or 1.8.18 (or later); versions from 0.42.0 up to 2.0.4 are affected. | ||
| CVE-2026-116591 | NOISE | 21 | 10 | 25 | 40 | 8.7 | 26.5 | none | none | klauspost | compress | 2026-10-26 | CISA SSVC: automatable | Upgrade klauspost/compress to version 1.20.2 or later. | ||
| CVE-2026-119777 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 7 · red hat enterprise linux 8 +1 more | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-119718 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | blender foundation | blender | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-120224 | NOISE | 21 | 11 | 13 | 50 | 9.9 | none | oray | pugongying x5 pro | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116807 | NOISE | 21 | 7 | 30 | 40 | 6.5 | 18.9 | poc | poc_early | openpanel-dev | openpanel | 2026-10-27 | CISA SSVC: public proof of concept | |||
| CVE-2026-119374 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | sqlite | sqlite | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-120228 | NOISE | 21 | 11 | 13 | 50 | 9.9 | none | wavlink | wn553x1-b | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119336 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | pi-hole | pi-hole | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-118650 | NOISE | 21 | 0 | 33 | 50 | 7.5 | 33.9 | none | labstack | echo | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-63344 | NOISE | 21 | 0 | 13 | 70 | 8.6 | none | christianhelle | refitter | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade Refitter to version 2.1.2 or later, which escapes content-type keys in generated attributes. | ||||
| CVE-2026-63346 | NOISE | 21 | 0 | 13 | 70 | 8.6 | none | christianhelle | refitter | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade Refitter to version 2.1.2 or later, which fixes the header-name attribute-string escaping flaw. | ||||
| CVE-2026-63398 | NOISE | 21 | 1 | 30 | 50 | 7.4 | none | roostorg | coop | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-78402 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | thalesgroup | sentinel keys server | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-119426 | NOISE | 21 | 9 | 25 | 40 | 7.5 | none | none | phpmyadmin | phpmyadmin | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-110971 | NOISE | 21 | 9 | 25 | 40 | 7.7 | none | none | zakład ubezpieczeń społecznych | płatnik | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-119722 | NOISE | 21 | 10 | 25 | 40 | 7.8 | none | none | blender foundation | blender | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-116693 | NOISE | 21 | 10 | 25 | 40 | 8.7 | 39.0 | none | none | datadog | dd-trace-js | 2026-10-27 | CISA SSVC: automatable | Upgrade dd-trace-js to 5.131.1 or 6.20.1 (or later). | ||
| CVE-2026-116097 | NOISE | 21 | 7 | 30 | 40 | 4.3 | 19.1 | poc | poc_early | n/a | cloudclassroom-php-project | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-118260 | NOISE | 21 | 9 | 25 | 40 | 8.2 | 31.1 | none | none | labstack | echo | 2026-10-28 | CISA SSVC: automatable | Upgrade to Echo 4.16.1 or later; versions from 4.0.0 through 4.16.0 are affected. | ||
| CVE-2025-13833 | NOISE | 21 | 0 | 33 | 50 | 7.7 | 4.1 | none | forescout technologies | secureconnector | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116506 | NOISE | 21 | 6 | 33 | 40 | 9.9 | 79.4 | none | totolink | a950rg | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-102816 | NOISE | 21 | 0 | 33 | 50 | 5.3 | 6.1 | none | tp-link systems inc. | re305 v3 | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96228 | NOISE | 21 | 5 | 33 | 40 | 8.1 | 41.1 | none | none | sslplugins | ssl wireless sms notification | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-63345 | NOISE | 21 | 0 | 13 | 70 | 8.6 | none | christianhelle | refitter | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade Refitter to version 2.1.2 or later, which fixes the unescaped path-emission sink. | ||||
| CVE-2024-58400 | NOISE | 21 | 9 | 25 | 40 | 8.2 | 36.5 | none | none | ggml-org | llama.cpp | 2026-10-27 | CISA SSVC: automatable | Upgrade llama.cpp to build b3701 or later, which contains the fix for the unvalidated token ID out-of-bounds read. | ||
| CVE-2026-119424 | NOISE | 21 | 0 | 33 | 50 | 6.8 | none | opnsense | core | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-39741 | NOISE | 21 | 7 | 30 | 40 | 5.3 | 13.7 | none | none | relywp | simple cloudflare turnstile | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-82214 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 4.8 | none | none | unknown | quick event manager | 2026-10-31 | CISA SSVC: automatable | |||
| CVE-2026-117509 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 34.9 | poc | poc_early | crownpku | rasa_nlu_chi | 2026-10-27 | CISA SSVC: public proof of concept | |||
| CVE-2026-9536 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 23.6 | none | none | vtk | vtk | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-118184 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 3.5 | none | none | unknown | premium packages | 2026-10-31 | CISA SSVC: automatable | |||
| CVE-2026-61840 | NOISE | 20 | 0 | 30 | 50 | 2.3 | none | none | vantern-org | questbot | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-5461 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 21.6 | none | none | wpmudev | forminator forms – contact form, payment form & custom form builder | 2026-10-30 | CISA SSVC: automatable | |||
| CVE-2026-115601 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 7.1 | none | none | wp desk | custom price for woocommerce | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-116399 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 5.8 | none | none | instawp | instawp connect | 2026-10-29 | CISA SSVC: total technical impact | Update the InstaWP Connect plugin to version 0.1.4.3 or later. | ||
| CVE-2026-119137 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 34.2 | none | none | bytecodealliance | wasmtime | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-116581 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 39.2 | none | none | lxsmnsyc | seroval | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-27401 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 15.4 | none | none | yith | yith paypal express checkout for woocommerce | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-107097 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 14.0 | none | none | unknown | royal addons for elementor | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-105997 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 22.6 | none | none | unknown | booking package | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-116744 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 37.4 | none | none | ntop | ndpi | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-119141 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 31.1 | none | none | bytecodealliance | wasmtime | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-54853 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 13.7 | none | none | cozmoslabs | profile builder | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-111418 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 37.8 | none | none | foxit software inc. | foxit.com | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-107023 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 4.7 | poc | poc_early | n/a | n/a | 2026-10-29 | CISA SSVC: public proof of concept | |||
| CVE-2026-116253 | NOISE | 20 | 8 | 25 | 40 | 7.3 | 42.2 | none | none | n/a | dedecms | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-118088 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 13.7 | none | none | wpfunnels team | wpfunnels | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-119561 | NOISE | 20 | 8 | 25 | 40 | 6.8 | none | none | phpmyadmin | phpmyadmin | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-61804 | NOISE | 20 | 7 | 0 | 65 | 8.1 | none | mytinywms | mytinywms | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to myTinyWMS 1.6.4 or later, which fixes the stored XSS in product and category name handling. | ||||
| CVE-2026-66091 | NOISE | 20 | 7 | 25 | 40 | 6.9 | 34.5 | none | none | apereo foundation | openequella | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-118081 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 31.4 | none | none | 10web | 10web social photo feed | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-116227 | NOISE | 20 | 7 | 25 | 40 | 2.4 | 10.7 | poc | poc_early | edimax | br-6208ac | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-116482 | NOISE | 20 | 7 | 25 | 40 | 3.5 | 16.8 | poc | poc_early | subhajitkhan | online-clinic-management-system | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-116117 | NOISE | 20 | 8 | 25 | 40 | 7.3 | 42.7 | none | none | halo-dev | halo | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-48884 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 20.9 | none | none | wedevs | wp user frontend | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-116856 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 13.7 | none | none | wp desk | flexible quantity – measurement price calculator for woocommerce | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-119575 | NOISE | 20 | 0 | 30 | 50 | 6.5 | none | arcadedata | arcadedb | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119052 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 49.4 | none | none | ggml-org | llama.cpp | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-90871 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 18.5 | none | none | progress software | ws_ftp server | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-118128 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 29.6 | none | none | a2aproject | a2a-js | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-118629 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 4.8 | none | none | unknown | all-in-one video gallery | 2026-10-31 | CISA SSVC: automatable | |||
| CVE-2026-107347 | NOISE | 20 | 0 | 13 | 65 | 8.4 | 2.8 | none | none | hashicorp | nomad enterprise | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to Nomad 2.1.0, or Nomad Enterprise 2.1.0, 1.11.12, or 1.10.18. | ||
| CVE-2026-116471 | NOISE | 20 | 7 | 25 | 40 | 4.3 | 9.6 | poc | poc_early | bkwld | decoy | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-116263 | NOISE | 20 | 7 | 25 | 40 | 4.6 | 2.9 | poc | poc_early | hascheksolutions | pictshare | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-118168 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 3.3 | none | none | unknown | mappress | 2026-11-01 | CISA SSVC: automatable | |||
| CVE-2026-90869 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 29.4 | none | none | progress software | ws_ftp server | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-93007 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 36.9 | none | none | red hat | red hat ceph storage 9 · red hat enterprise linux 10 · red hat enterprise linux 6 +7 more | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-119978 | NOISE | 20 | 8 | 13 | 50 | 8.5 | none | flowiseai | flowise | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118681 | NOISE | 20 | 0 | 38 | 40 | 3.7 | 15.6 | none | go-chi | chi | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118238 | NOISE | 20 | 8 | 25 | 40 | 7.2 | none | none | tenda | w18e | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-62334 | NOISE | 20 | 25 | 0 | 30 | 8.7 | none | none | openvm-org | openvm | 2026-10-30 | CISA SSVC: automatable | Upgrade to 1.7.0, 2.0.0-rc.3 or 2.1.0-preview or later, which fix the verifier dispatch issue. | |||
| CVE-2026-116866 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 21.3 | none | none | dotstore | extra fees plugin for woocommerce | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-8822 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 23.6 | none | none | vtk | vtk | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2025-8574 | NOISE | 20 | 8 | 13 | 50 | 8.7 | none | none | tigroumeow | database cleaner: cleanup, optimization & repair | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115958 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 23.9 | none | none | wp discussion board | wp discussion board | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-40063 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 21.4 | none | none | frangoteam | frangoteam | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-119053 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 41.6 | none | none | lwip | lwip | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-114173 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 21.1 | none | none | canva | ortto | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-93855 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 35.4 | none | none | brewlabs | sendpress newsletters | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-115599 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 24.7 | none | none | thimpress | learnpress | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-110184 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 36.7 | none | none | blazethemes | newsmatic | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-116863 | NOISE | 20 | 8 | 25 | 40 | 9.6 | 7.2 | none | none | tribulant software | newsletters | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-116391 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 31.4 | none | none | gs plugins | gs logo slider | 2026-10-28 | CISA SSVC: total technical impact | Update the GS Logo Slider plugin to version 3.9.0 or later. | ||
| CVE-2026-90870 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 19.3 | none | none | progress software | ws_ftp server | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-116237 | NOISE | 20 | 8 | 13 | 50 | 8.4 | 51.4 | none | oray | pugongying x5 pro | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117541 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 24.3 | none | none | darylldoyle | svg-sanitizer | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-119708 | NOISE | 20 | 0 | 38 | 40 | 6.5 | none | colinin | abp-next-admin | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118029 | NOISE | 20 | 0 | 30 | 50 | 5.9 | 6.4 | none | aws | aws-sdk-pandas | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118663 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 29.0 | none | none | honojs | node-server | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-116776 | NOISE | 20 | 7 | 25 | 40 | 7.0 | 7.3 | poc | poc_early | n-romanovich | usb-test | 2026-10-28 | CISA SSVC: public proof of concept | |||
| CVE-2026-116778 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 40.5 | none | none | fogproject | fogproject | 2026-10-28 | CISA SSVC: total technical impact | Upgrade to FOG 1.5.10.2253 or later, or 1.6.0-RC-1 or later. | ||
| CVE-2026-119028 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 36.5 | none | none | oapi-codegen | oapi-codegen | 2026-10-29 | CISA SSVC: total technical impact | Upgrade oapi-codegen to 2.8.1 or later (fixed in v2.8.1; versions 2.0.0 through 2.8.0 are affected). | ||
| CVE-2026-41216 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 20.3 | none | none | vtk | vtk | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-116389 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 21.3 | none | none | crossi72 | phoenix media rename | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-115591 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 26.9 | none | none | supsystic | contact form by supsystic | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-115255 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 14.0 | none | none | unknown | wp roster | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-111314 | NOISE | 20 | 7 | 25 | 40 | 7.2 | 15.3 | none | none | cservit | affiliate-toolkit – multi-network affiliate & amazon product display | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-107100 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 18.0 | none | none | unknown | royal addons for elementor | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-116690 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 46.6 | none | none | mlflow | mlflow | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-116103 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 14.3 | poc | poc_early | sony | neural network libraries | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-109999 | NOISE | 20 | 7 | 25 | 40 | 7.2 | 21.8 | none | none | nalam-1 | ai marketing expert — ai email marketing, ai content generator, seo analyzer, ai workflow automation, social media & ai chatbot | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-84243 | NOISE | 20 | 8 | 25 | 40 | 7.0 | none | none | the gnu c library | glibc | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-103403 | NOISE | 20 | 4 | 33 | 40 | 8.8 | 67.7 | none | juniper networks | session smart router · session smart conductor | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to Session Smart Router or Conductor 7.0.5, 7.1.7, 7.2.3 or later; no workarounds are available. | |||
| CVE-2026-61627 | NOISE | 20 | 9 | 20 | 40 | 7.3 | none | none | libass | libass | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2014-125136 | NOISE | 20 | 7 | 25 | 40 | 5.9 | 35.5 | poc | poc_early | c97net | qengine cms · kemana directory · cart engine | 2026-10-28 | CISA SSVC: public proof of concept | |||
| CVE-2026-59185 | NOISE | 20 | 0 | 38 | 40 | 8.5 | 25.0 | none | none | identrail | identrail | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to identrail 1.0.2 or later, which fixes the installation-ownership gap. | ||
| CVE-2026-116393 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 24.7 | none | none | ihomefinder, inc. | optima express | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-116886 | NOISE | 20 | 7 | 25 | 40 | 5.4 | 3.3 | none | none | semanticmediawiki | semanticmediawiki | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-116890 | NOISE | 20 | 8 | 25 | 40 | 7.3 | 8.8 | none | none | semanticmediawiki | semanticmediawiki | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-116746 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 16.4 | none | none | qloapps | qloapps | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-118761 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 42.5 | none | none | kubeflow | pipelines | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-104591 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 39.3 | none | none | n/a | n/a | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-89435 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 33.4 | none | none | strategy11team | formidable forms – contact form, survey, quiz, payment, calculator form & custom form builder | 2026-10-30 | CISA SSVC: total technical impact | |||
| CVE-2026-119168 | NOISE | 20 | 0 | 13 | 65 | 8.8 | 2.9 | none | none | hashicorp | nomad enterprise | 2026-10-29 | CISA SSVC: total technical impact | Upgrade to Nomad 2.1.0, or Nomad Enterprise 2.1.0, 1.11.12, or 1.10.18. | ||
| CVE-2026-116822 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 11.3 | none | none | yeswiki | yeswiki | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-54852 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 8.8 | none | none | miniorange | page restriction wordpress (wp) | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-103312 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 14.7 | none | none | unknown | payment integration wompi | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-118080 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 31.4 | none | none | social snap | social snap | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-118076 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 31.4 | none | none | frisbii | frisbii pay | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-116878 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 30.3 | none | none | semanticmediawiki | semanticmediawiki | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-114181 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 15.4 | none | none | magepeople inc. | taxi booking manager for woocommerce | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-116640 | NOISE | 20 | 7 | 25 | 40 | 3.5 | 9.7 | poc | poc_early | saruf-ratul | hr-payroll-management-system | 2026-10-27 | CISA SSVC: public proof of concept | |||
| CVE-2026-119286 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 36.5 | none | none | graphql-python | graphql-core | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-116577 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 32.4 | none | none | tornadoweb | tornado | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-119118 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 8.3 | poc | poc_early | unclecode | crawl4ai | 2026-10-29 | CISA SSVC: public proof of concept | |||
| CVE-2026-119249 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 26.9 | none | none | ubiquiti inc | wifiman desktop | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-116557 | NOISE | 20 | 9 | 13 | 50 | 9.1 | none | murgroland | wp booking system – booking calendar | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-39782 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 17.2 | none | none | kaliforms | kali forms | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-103330 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 5.4 | none | none | unknown | sadad qa payment | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-116340 | NOISE | 20 | 7 | 25 | 40 | 4.3 | 23.1 | poc | poc_early | iflytek | astron-agent | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-116773 | NOISE | 20 | 7 | 25 | 40 | 4.3 | 17.5 | poc | poc_early | eugeny | russh | 2026-10-27 | CISA SSVC: public proof of concept | |||
| CVE-2026-119577 | NOISE | 20 | 8 | 25 | 40 | 6.8 | none | none | arcadedata | arcadedb | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-97645 | NOISE | 20 | 7 | 25 | 40 | 7.2 | 8.7 | none | none | gravity forms | gravity forms | 2026-10-30 | CISA SSVC: automatable | |||
| CVE-2026-104368 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 28.3 | none | none | webtoffee | export and import users and customers | 2026-10-30 | CISA SSVC: total technical impact | |||
| CVE-2026-116387 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 7.1 | none | none | brainstorm force | sureforms | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-116586 | NOISE | 20 | 7 | 25 | 40 | 6.9 | 21.8 | none | none | go-jose | go-jose | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-116689 | NOISE | 20 | 7 | 25 | 40 | 5.9 | 18.8 | poc | poc_early | follow-redirects | follow-redirects | 2026-10-27 | CISA SSVC: public proof of concept | |||
| CVE-2026-118073 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 33.2 | none | none | blazethemes | news kit elementor addons | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-118082 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 29.8 | none | none | buddyboss | buddyboss platform | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-118091 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 7.1 | none | none | wpfunnels team | wpfunnels | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-119288 | NOISE | 20 | 8 | 25 | 40 | 7.0 | none | none | zuke-build | zuke | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-90437 | NOISE | 20 | 7 | 25 | 40 | 7.2 | 8.7 | none | none | gravity forms | gravity forms | 2026-10-30 | CISA SSVC: automatable | |||
| CVE-2026-118089 | NOISE | 20 | 8 | 25 | 40 | 7.2 | none | none | rextheme | product feed manager | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-54854 | NOISE | 20 | 8 | 25 | 40 | 6.3 | none | none | cozmoslabs | profile builder | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-119325 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 15.3 | none | none | bricks | bricks theme | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-119409 | NOISE | 20 | 8 | 25 | 40 | 7.2 | none | none | opnsense | core | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-118083 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 23.0 | none | none | themeum | wp crowdfunding | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-86715 | NOISE | 20 | 8 | 25 | 40 | 7.1 | none | none | crypttech crypto and informatics technologies industry and trade inc. | vatos dlp | 2026-10-30 | CISA SSVC: total technical impact | ||||
| CVE-2026-109821 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 42.5 | poc | poc_early | elixir-lang | elixir | 2026-10-30 | CISA SSVC: public proof of concept | |||
| CVE-2026-119124 | NOISE | 20 | 0 | 25 | 55 | 5.5 | 2.1 | none | imagemagick | imagemagick | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-96581 | NOISE | 20 | 4 | 30 | 40 | 7.6 | 17.3 | none | none | ash-project | ash | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-116229 | NOISE | 20 | 7 | 25 | 40 | 3.5 | 10.2 | poc | poc_early | ffxiv-teamcraft | ffxiv teamcraft | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-116224 | NOISE | 20 | 7 | 25 | 40 | 4.3 | 13.9 | poc | poc_early | fr0tt | benotes | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-116114 | NOISE | 20 | 7 | 25 | 40 | 3.7 | 8.3 | poc | poc_early | yoosee | gm8135s camera | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-88928 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 5.6 | none | none | unknown | paycomet for woocommerce | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-118683 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 41.9 | none | none | project-monai | monai | 2026-10-28 | CISA SSVC: total technical impact | Upgrade MONAI to 1.6.1 or later; versions from 1.2.0 before 1.6.1 are affected. | ||
| CVE-2026-118651 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 10.8 | none | none | labstack | echo | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-118265 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 3.2 | none | none | labstack | echo | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-59959 | NOISE | 20 | 7 | 25 | 40 | 4.8 | 2.2 | poc | poc_early | happyseafox | sail | 2026-10-28 | CISA SSVC: public proof of concept | |||
| CVE-2026-82104 | NOISE | 20 | 8 | 25 | 40 | 9.4 | 35.9 | none | none | teltonika networks | rutx · rutm · rutc +10 more | 2026-10-30 | CISA SSVC: total technical impact | |||
| CVE-2026-90864 | NOISE | 20 | 7 | 25 | 40 | 9.1 | 41.3 | none | none | progress software | ws_ftp server | 2026-10-29 | CISA SSVC: total technical impact | No patch is stated; Progress advises limiting delegated administrative privileges to trusted personnel, reviewing folder configurations and account permissions, and contacting Progress Support for mitigation guidance. | ||
| CVE-2026-116210 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 6.8 | poc | poc_early | webasyst | webasyst framework | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-118093 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 13.7 | none | none | wpfunnels team | product feed manager | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-27063 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 8.3 | none | none | kit | kit (formerly convertkit) | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-115906 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 4.2 | poc | poc_early | zip-rs | zip2 | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-111974 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 9.0 | none | none | unknown | givewp | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-103381 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 3.1 | none | none | unknown | mintpay for woocommerce | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-118075 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 31.4 | none | none | dbarrere | wp media folders | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-114193 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 24.7 | none | none | eyal fitoussi | geo my wordpress | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-116106 | NOISE | 20 | 8 | 25 | 40 | 7.3 | 28.5 | none | none | n/a | heycyan app | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-97073 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 17.9 | none | none | mycred | mycred | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-48200 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 20.7 | none | none | barn2 plugins | document library lite | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-54871 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 19.3 | none | none | mamunur rashid | shopbuilder – elementor woocommerce builder addons | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-116846 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 22.9 | none | none | wp user manager | wp user manager | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-115302 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 7.8 | none | none | unknown | contact form by supsystic | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-114270 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 10.7 | none | none | unknown | geodirectory | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-114443 | NOISE | 20 | 4 | 33 | 40 | 7.5 | 2.8 | none | none | unknown | security plugin, firewall & malware scanner with auto removal | 2026-10-30 | CISA SSVC: total technical impact | |||
| CVE-2026-118775 | NOISE | 20 | 7 | 25 | 40 | 3.7 | 24.3 | poc | poc_early | digitalbazaar | forge | 2026-10-29 | CISA SSVC: public proof of concept | |||
| CVE-2026-119188 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 35.4 | none | none | digitalbazaar | forge | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-8824 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 23.6 | none | none | vtk | vtk | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-42057 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 20.3 | none | none | vtk | vtk | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-118759 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 27.0 | none | none | kubeflow | pipelines | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-107080 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 8.1 | poc | poc_early | n/a | n/a | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-119193 | NOISE | 20 | 3 | 25 | 50 | 5.4 | 1.4 | none | none | sebastianbergmann | phpunit | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-119197 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 36.8 | none | none | pyasn1 | pyasn1 | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-118256 | NOISE | 20 | 7 | 25 | 40 | 2.1 | 41.4 | poc | poc_early | intlify | vue-i18n | 2026-10-28 | CISA SSVC: public proof of concept | |||
| CVE-2026-116219 | NOISE | 20 | 8 | 25 | 40 | 7.2 | 81.5 | none | none | dolibarr | dolibarr | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-25450 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 13.7 | none | none | themegrill | user registration | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-119205 | NOISE | 20 | 7 | 25 | 40 | 7.1 | 23.2 | none | none | py-pdf | pypdf | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-116461 | NOISE | 20 | 7 | 25 | 40 | 4.3 | 12.6 | poc | poc_early | omega solution | restro pos | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-120225 | NOISE | 20 | 9 | 13 | 50 | 9.1 | none | oray | pugongying x5 pro | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115927 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 32.4 | none | none | tornadoweb | tornado | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-116515 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 16.3 | poc | poc_early | itsourcecode | online book store | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-116556 | NOISE | 20 | 7 | 25 | 40 | 2.4 | 11.2 | poc | poc_early | n/a | argilla | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-116587 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 30.5 | none | none | go-jose | go-jose | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-116809 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 11.1 | none | none | openpanel-dev | openpanel | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-111120 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 24.4 | none | none | e4jvikwp | vikrentcar car rental management system | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-117556 | NOISE | 20 | 7 | 25 | 40 | 4.3 | 25.9 | none | none | zchunk | zchunk | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-118272 | NOISE | 20 | 7 | 25 | 40 | 4.3 | 16.1 | poc | poc_early | a2ui-project | a2ui | 2026-10-28 | CISA SSVC: public proof of concept | |||
| CVE-2026-57186 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 48.8 | none | none | asterisk | certified-asterisk | 2026-10-27 | CISA SSVC: automatable | |||
| CVE-2026-58255 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 35.8 | none | none | jhuckaby | cronicle | 2026-10-27 | CISA SSVC: total technical impact | Upgrade to Cronicle 0.9.121 or later, which fixes the event uid/gid injection. | ||
| CVE-2026-103372 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 18.0 | none | none | unknown | payconiq | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-103382 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 14.0 | none | none | unknown | casso flow | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-106002 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 14.0 | none | none | unknown | court reservation | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-106648 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 23.1 | none | none | unknown | royal elementor addons | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-107098 | NOISE | 20 | 3 | 25 | 50 | 6.8 | 24.6 | none | none | unknown | royal addons for elementor | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-110292 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 13.0 | none | none | unknown | payplug for woocommerce (official) | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-110508 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 19.6 | none | none | unknown | essential addons for elementor | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-111577 | NOISE | 20 | 3 | 25 | 50 | 7.2 | 27.4 | none | none | unknown | gosmtp | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-113813 | NOISE | 20 | 7 | 25 | 40 | 6.5 | 11.1 | none | none | unknown | payplug for woocommerce (official) | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-115225 | NOISE | 20 | 7 | 25 | 40 | 5.8 | 15.8 | none | none | unknown | customer engagement system | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-117574 | NOISE | 20 | 0 | 38 | 40 | 9.1 | 14.7 | none | red hat | red hat openshift ai (rhoai) | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116613 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 20.1 | none | none | bplugins | animated text block – add typing and looping text effects | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-1928 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 45.3 | none | none | rankmath | rank math seo – ai seo tools to dominate seo rankings | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-2839 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 19.9 | none | none | hwk-fr | advanced custom fields: extended | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-57184 | NOISE | 20 | 7 | 25 | 40 | 6.3 | 46.6 | none | none | asterisk | certified-asterisk | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-75891 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 23.3 | none | none | themeum | kirki – freeform page builder, website builder & customizer | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-107672 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 27.1 | none | none | autodesk | fusion post processor utility | 2026-10-27 | CISA SSVC: total technical impact | Upgrade the Autodesk Fusion Post Processor Utility Extension to version 5.0.2 or later (affected: 5.0.1 and earlier). | ||
| CVE-2026-93864 | NOISE | 20 | 3 | 33 | 40 | 7.1 | 2.8 | none | none | watchguard | fireware os | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-103693 | REVIEW | 20 | 7 | 25 | 40 | 9.0 | 40.6 | none | none | unknown | frontend dashboard · profilegrid | 2026-10-29 | CISA SSVC: total technical impact; floor: pre-auth, no-user-interaction CVSS 9 with a fix available is never below REVIEW | Update Frontend Dashboard to 3.0.5 or later and ProfileGrid to 6.0.0.5 or later. | ||
| CVE-2026-110030 | NOISE | 20 | 3 | 25 | 50 | 5.3 | 11.7 | none | none | unknown | hide price until login | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-115282 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 10.7 | none | none | unknown | recipe card blocks lite | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-78395 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 7.8 | none | none | unknown | link library | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-78396 | NOISE | 20 | 3 | 25 | 50 | 5.3 | 10.7 | none | none | unknown | link library | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-111417 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 28.1 | none | none | foxit software inc. | foxit.com | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-116803 | NOISE | 20 | 7 | 25 | 40 | 6.1 | 5.6 | poc | poc_early | cure53 | dompurify | 2026-10-27 | CISA SSVC: public proof of concept | |||
| CVE-2026-115415 | NOISE | 20 | 0 | 30 | 50 | 6.5 | 27.8 | none | amazon | strands-agents-tools | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-66090 | NOISE | 20 | 0 | 30 | 50 | 7.1 | 19.1 | none | none | apereo foundation | openequella | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-33923 | NOISE | 20 | 3 | 25 | 50 | 7.2 | 13.4 | none | none | nozomi networks | guardian · cmc | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-116867 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 31.4 | none | none | sosidee | dynamic qr code – generator | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-118589 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 34.8 | none | none | nschloe | meshio | 2026-10-29 | CISA SSVC: automatable | |||
| CVE-2026-118694 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 39.3 | none | none | trentm | python-markdown2 | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-118755 | NOISE | 20 | 8 | 25 | 40 | 7.2 | 72.6 | none | none | volmarg | personal-management-system | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-104596 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 33.1 | none | none | n/a | n/a | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-116100 | NOISE | 20 | 7 | 25 | 40 | 2.4 | 10.1 | poc | poc_early | n/a | gougucms | 2026-10-26 | CISA SSVC: public proof of concept | |||
| CVE-2026-110509 | NOISE | 20 | 7 | 25 | 40 | 5.3 | 16.5 | none | none | unknown | essential addons for elementor | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-118257 | NOISE | 20 | 7 | 25 | 40 | 7.2 | 19.6 | none | none | intlify | vue-i18n | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-22105 | NOISE | 20 | 11 | 13 | 45 | 8.7 | none | none | delta electronics | delta ufc500 | 2026-10-30 | CISA SSVC: total technical impact | Upgrade the msi-image to 2.4.18 or later and the ECP component to 4.4.1 or later; also set a non-default Service account password. | |||
| CVE-2026-92797 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 4.0 | none | none | memberpress | memberpress | 2026-10-28 | CISA SSVC: total technical impact | Upgrade MemberPress to version 1.14.2 or later, which is the release referenced in the vendor change log for this fix. | ||
| CVE-2026-116585 | NOISE | 20 | 7 | 25 | 40 | 6.9 | 18.4 | none | none | go-jose | go-jose | 2026-10-26 | CISA SSVC: automatable | |||
| CVE-2026-118804 | NOISE | 20 | 8 | 25 | 40 | 7.5 | 16.3 | none | none | bricks | bricks builder | 2026-10-28 | CISA SSVC: automatable | |||
| CVE-2026-116868 | NOISE | 20 | 7 | 25 | 40 | 8.8 | 38.8 | none | none | buddydev | buddypress xprofile custom field types | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-116880 | NOISE | 20 | 7 | 25 | 40 | 7.1 | 1.1 | poc | poc_early | semanticmediawiki | semanticmediawiki | 2026-10-27 | CISA SSVC: public proof of concept | |||
| CVE-2026-116876 | NOISE | 20 | 7 | 25 | 40 | 7.1 | 14.5 | poc | poc_early | semanticmediawiki | semanticmediawiki | 2026-10-27 | CISA SSVC: public proof of concept | |||
| CVE-2026-116842 | NOISE | 20 | 7 | 25 | 40 | 6.1 | 2.9 | poc | poc_early | diasurgical | devilutionx | 2026-10-27 | CISA SSVC: public proof of concept | |||
| CVE-2026-116828 | NOISE | 20 | 7 | 25 | 40 | 4.9 | 16.4 | poc | poc_early | yeswiki | yeswiki | 2026-10-27 | CISA SSVC: public proof of concept | |||
| CVE-2026-116824 | NOISE | 20 | 7 | 25 | 40 | 6.1 | 7.5 | poc | poc_early | yeswiki | yeswiki | 2026-10-27 | CISA SSVC: public proof of concept | |||
| CVE-2026-116724 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 3.9 | none | none | fltk | fltk | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-65631 | NOISE | 19 | 0 | 25 | 50 | 6.9 | 14.4 | none | potatosalad | jose | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116593 | NOISE | 19 | 0 | 25 | 50 | 11.6 | none | apache software foundation | apache kafka | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120206 | NOISE | 19 | 0 | 25 | 50 | 5.9 | none | thelia | thelia core · thelia back-office default twig template · thelia back-office default template +1 more | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-82119 | REVIEW | 19 | 6 | 25 | 40 | 9.8 | 64.2 | none | hitachi | hirdb server version 10 · hirdb server version 9(32) · hirdb server with additional function version 9(32) | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Upgrade HiRDB Server Version 10 to 10-12-01 or later; Version 9 fixes are listed in Hitachi advisory hitachi-sec-2026-146. | |||
| CVE-2026-103506 | NOISE | 19 | 0 | 25 | 50 | 8.9 | 19.1 | none | grafana | grafana enterprise · grafana oss | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116252 | NOISE | 19 | 0 | 25 | 50 | 6.5 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116251 | NOISE | 19 | 0 | 25 | 50 | 4.2 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-13162 | NOISE | 19 | 0 | 25 | 50 | 7.7 | 8.1 | none | hitachi energy | coretec 5 · coretec 4 | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-63121 | NOISE | 19 | 0 | 25 | 50 | 6.3 | none | kubewarden | policies | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107896 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 2.3 | none | none | fuji electric co., ltd. / hakko electronics co., ltd. | v-sft | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-116677 | NOISE | 19 | 0 | 25 | 50 | 5.3 | 6.9 | none | openwisp | openwisp-controller | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-120195 | NOISE | 19 | 6 | 13 | 50 | 10.0 | none | wavlink | wl-wn579a3-a | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110185 | NOISE | 19 | 0 | 25 | 50 | 5.9 | 46.1 | none | none | bitpressadmin | bit flows: ai agent automation & integrations for forms, crm, ecommerce, google sheets, and more | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-107897 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 2.3 | none | none | fuji electric co., ltd. / hakko electronics co., ltd. | v-sft | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-113409 | NOISE | 19 | 0 | 25 | 50 | 4.8 | 9.3 | none | none | canva | ortto | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119715 | NOISE | 19 | 0 | 25 | 50 | 4.3 | none | nocodb | nocodb | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-104739 | NOISE | 19 | 0 | 25 | 50 | 4.9 | none | none | rabilal | js help desk – ai-powered support & ticketing system | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-56828 | NOISE | 19 | 0 | 25 | 50 | 8.8 | 38.3 | none | shopperlabs | shopper | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to Shopper 2.8.1 or later, which fixes the authorization gaps in the team settings Livewire components. | |||
| CVE-2026-120250 | NOISE | 19 | 0 | 25 | 50 | 5.3 | none | marketcalls | openalgo | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109823 | NOISE | 19 | 0 | 25 | 50 | 2.3 | 30.6 | none | tidewave-ai | tidewave | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-103409 | REVIEW | 19 | 1 | 33 | 40 | 9.8 | 28.3 | none | juniper networks | session smart router | 2026-10-28 | floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Upgrade Session Smart Router to 7.0.5, 7.1.7, 7.2.3 or later; no workarounds are available. | |||
| CVE-2026-119289 | NOISE | 19 | 0 | 25 | 50 | 7.1 | none | zuke-build | zuke | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109385 | NOISE | 19 | 0 | 25 | 50 | 6.4 | 17.2 | none | none | posimyththemes | uichemy – convert figma, prompts and ai builds to elementor, gutenberg and bricks | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2015-20129 | NOISE | 19 | 0 | 25 | 50 | 8.8 | 4.3 | none | crushftp | crushftp | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to CrushFTP 7.3.0 or later, which is unaffected. | |||
| CVE-2026-118243 | NOISE | 19 | 0 | 25 | 50 | 5.3 | 28.8 | none | highcharts | highcharts | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118242 | NOISE | 19 | 0 | 25 | 50 | 8.5 | 23.3 | none | highcharts, @highcharts | highcharts · grid-lite · grid-pro | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade @highcharts/grid-lite and @highcharts/grid-pro to 3.2.0 or later; Highcharts core is affected below 13.1.0. | |||
| CVE-2026-50571 | NOISE | 19 | 0 | 25 | 50 | 5.7 | 14.2 | none | none | w3c | websub | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-110001 | NOISE | 19 | 0 | 25 | 50 | 5.4 | none | none | foliovision | fv flowplayer video player | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118763 | NOISE | 19 | 0 | 25 | 50 | 7.4 | 22.7 | none | none | sigstore | sigstore-js | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-112375 | NOISE | 19 | 0 | 25 | 50 | 13.0 | none | apache software foundation | apache kafka | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110985 | NOISE | 19 | 0 | 25 | 50 | 2.3 | none | apache software foundation | apache kafka | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119564 | NOISE | 19 | 0 | 25 | 50 | 5.3 | none | none | plausible | plausible analytics | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115644 | NOISE | 19 | 0 | 25 | 50 | 17.5 | none | apache software foundation | apache kafka | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110023 | NOISE | 19 | 0 | 25 | 50 | 5.9 | none | peterschulznl | wp data access – app builder for tables, forms, dashboards, charts & maps | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-61571 | NOISE | 19 | 0 | 25 | 50 | 7.3 | 20.5 | none | wwbn | avideo-encoder | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118762 | NOISE | 19 | 0 | 25 | 50 | 9.3 | 25.0 | none | monkeytypegame | monkeytype | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to Monkeytype 26.43.0 or later, which fixes the CI workflow issue. | |||
| CVE-2026-118668 | NOISE | 19 | 6 | 25 | 40 | 8.6 | 30.8 | none | none | langchain-ai | langgraph-api | 2026-10-28 | CISA SSVC: total technical impact | Upgrade langgraph-api to version 0.15.0 or later. | ||
| CVE-2026-54453 | NOISE | 19 | 0 | 25 | 50 | 7.2 | 38.0 | none | opencats | opencats | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110879 | REVIEW | 19 | 6 | 25 | 40 | 9.8 | 68.1 | none | fasterxml | jackson-databind | 2026-10-28 | Pre-auth, no-interaction deserialization bypass of the earlier CVE-2026-54512 fix in jackson-databind, a library embedded in countless Java services. No public exploit code or active exploitation is confirmed, and EPSS is low at 0.012. | Upgrade jackson-databind to 2.18.12+, 2.21.8+, 2.22.4+ (2.x) or 3.1.8+/3.2.4+ (3.x), then restart services. Until then, avoid enabling default typing or @JsonTypeInfo(use=Id.CLASS) on untrusted input and audit integrations that expose it. | |||
| CVE-2026-77054 | NOISE | 19 | 0 | 25 | 50 | 6.9 | none | none | boneio | boneio | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116895 | NOISE | 19 | 0 | 25 | 50 | 5.4 | 0.8 | none | redaxo | core | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-120230 | NOISE | 19 | 6 | 13 | 50 | 9.9 | none | wavlink | wn701ae | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116684 | NOISE | 19 | 0 | 25 | 50 | 6.8 | 30.4 | none | modelcontextprotocol | python-sdk | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117563 | NOISE | 19 | 0 | 25 | 50 | 5.4 | 12.9 | none | zmister2016 | mrdoc | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116815 | NOISE | 19 | 0 | 25 | 50 | 4.3 | 13.9 | none | none | openpanel-dev | openpanel | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-67400 | NOISE | 19 | 0 | 25 | 50 | 3.5 | 7.6 | none | nextcloud | richdocuments | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-14571 | REVIEW | 19 | 0 | 25 | 50 | 9.1 | 16.5 | none | futurum software | futurum software user authentication module | 2026-10-28 | floor: pre-auth, no-user-interaction CVSS 9.1 with a fix available is never below REVIEW | The vulnerability has been fixed in Futurum Software’s user authentication module; affected versions are those before May 2026. | |||
| CVE-2026-118593 | NOISE | 19 | 0 | 25 | 50 | 5.9 | 9.8 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +4 more | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-84231 | NOISE | 19 | 1 | 25 | 50 | 7.4 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107898 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 2.3 | none | none | fuji electric co., ltd. / hakko electronics co., ltd. | v-sft | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-105258 | NOISE | 19 | 0 | 25 | 50 | 3.5 | 6.8 | none | none | unknown | appointment booking plugin | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-107899 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 2.3 | none | none | fuji electric co., ltd. / hakko electronics co., ltd. | v-sft | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-107900 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 2.3 | none | none | fuji electric co., ltd. / hakko electronics co., ltd. | v-sft | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-117688 | NOISE | 19 | 0 | 25 | 50 | 5.3 | 19.9 | none | red hat | red hat build of keycloak · red hat single sign-on 7 | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76938 | REVIEW | 19 | 6 | 25 | 40 | 9.8 | 50.8 | none | hitachi | jp1/automatic job management system 3 – manager | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Update JP1/Automatic Job Management System 3 – Manager to 13-50-31, 12-60-53 or 11-50-39 (or later) per Hitachi advisory hitachi-sec-2026-142. | |||
| CVE-2026-115923 | NOISE | 19 | 0 | 25 | 50 | 6.5 | none | backstage | backstage | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119727 | NOISE | 19 | 0 | 25 | 50 | 6.5 | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 7 · red hat enterprise linux 8 +1 more | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-95863 | NOISE | 19 | 1 | 25 | 50 | 7.6 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115299 | NOISE | 19 | 0 | 25 | 50 | 5.4 | 0.5 | none | none | unknown | contact form by supsystic | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118131 | NOISE | 19 | 0 | 25 | 50 | 8.3 | none | gnupg | gnupg | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-82704 | NOISE | 19 | 0 | 25 | 50 | 6.9 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116816 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 2.9 | none | none | ggml-org | llama.cpp | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-93851 | NOISE | 19 | 5 | 25 | 40 | 8.0 | 18.8 | none | none | mattermost | mattermost | 2026-10-28 | CISA SSVC: total technical impact | Update Mattermost to 11.10.0, 11.9.2, 11.8.6, or 11.7.11 or higher. | ||
| CVE-2026-118947 | NOISE | 19 | 0 | 25 | 50 | 4.3 | none | red hat | red hat build of keycloak · red hat single sign-on 7 | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-59172 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 5.3 | none | none | candid82 | joker | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-120282 | NOISE | 19 | 6 | 13 | 50 | 9.9 | none | wavlink | wn536ax6-a | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-85007 | NOISE | 19 | 0 | 25 | 50 | 3.8 | 4.4 | none | none | unknown | video player for youtube | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-115194 | NOISE | 19 | 0 | 25 | 50 | 6.5 | none | none | affected product not stated | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-82962 | NOISE | 19 | 0 | 25 | 50 | 6.5 | 18.3 | none | zephyrproject | zephyr | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-83539 | NOISE | 19 | 1 | 25 | 50 | 7.4 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105616 | NOISE | 19 | 0 | 25 | 50 | 5.7 | 9.1 | none | dalibo | postgresql anonymizer | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-11396 | NOISE | 19 | 0 | 25 | 50 | 5.3 | none | woobewoo | product filter for woocommerce by wbw | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-103665 | NOISE | 19 | 6 | 25 | 40 | 8.4 | 9.1 | none | none | yamaha corporation | yamaha lan monitor for windows | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-114349 | NOISE | 19 | 0 | 25 | 50 | 16.1 | none | apache software foundation | apache kafka | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111073 | NOISE | 19 | 0 | 25 | 50 | 10.3 | none | apache software foundation | apache kafka | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119300 | NOISE | 19 | 0 | 25 | 50 | 6.5 | none | wekan | wekan | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-44344 | NOISE | 19 | 0 | 25 | 50 | 6.6 | none | chamilo | chamilo-lms | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116622 | NOISE | 19 | 0 | 25 | 50 | 7.2 | 15.3 | none | none | wpscripts | food store – online food delivery & pickup | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-116231 | NOISE | 19 | 6 | 13 | 50 | 9.9 | 37.6 | none | oray | pugongying x5 pro | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-19742 | NOISE | 19 | 0 | 25 | 50 | 3.7 | none | none | zephyrproject | zephyr | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116575 | NOISE | 19 | 3 | 30 | 40 | 6.3 | 1.2 | none | none | mem0ai | mem0 | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-101274 | NOISE | 19 | 0 | 25 | 50 | 6.9 | 33.4 | none | pretix | pretix | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-104189 | NOISE | 19 | 0 | 25 | 50 | 7.5 | 29.0 | none | maz1987in | 3dviewer-nextcloud | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-19610 | NOISE | 19 | 0 | 25 | 50 | 6.5 | 11.0 | none | none | red hat | red hat jboss enterprise application platform 7 · red hat jboss enterprise application platform 8 · red hat jboss enterprise application platform expansion pack +1 more | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-101935 | NOISE | 19 | 0 | 25 | 50 | 6.1 | 16.9 | none | none | echoplugins | echo knowledge base – documentation, faqs, chat & smart search | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-117616 | NOISE | 19 | 0 | 25 | 50 | 11.5 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2024-3586 | NOISE | 19 | 0 | 25 | 50 | 3.5 | 6.8 | none | none | unknown | letterpress | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2025-12523 | NOISE | 19 | 0 | 25 | 50 | 6.5 | 11.6 | none | none | centreon | centreon | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2025-62841 | NOISE | 19 | 6 | 25 | 40 | 8.7 | 15.8 | none | none | qnap systems inc. | hbs 3 hybrid backup sync | 2026-10-29 | CISA SSVC: total technical impact | Update HBS 3 Hybrid Backup Sync to 26.4.0.521 or later, and Hybrid Backup Sync to 26.4.0.521 or later (26.4.1.563 or later for the second product line). | ||
| CVE-2026-119199 | NOISE | 19 | 0 | 25 | 50 | 5.9 | 28.7 | none | none | nuxt | nuxt | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119562 | NOISE | 19 | 0 | 25 | 50 | 4.2 | none | phpmyadmin | phpmyadmin | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107629 | NOISE | 19 | 0 | 25 | 50 | 5.4 | 27.6 | none | none | wpsoul | greenshift – animation and page builder blocks | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-110707 | NOISE | 19 | 0 | 25 | 50 | 4.7 | 23.2 | none | none | themeisle | rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregator | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119201 | NOISE | 19 | 0 | 25 | 50 | 4.8 | 10.5 | none | none | nuxt | nuxt | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119427 | NOISE | 19 | 0 | 25 | 50 | 4.2 | none | phpmyadmin | phpmyadmin | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-70380 | NOISE | 19 | 0 | 25 | 50 | 5.3 | 23.4 | none | wolfvision | cynap pro, cynap core pro, cynap pure, cynap pure mini, cynap pure pro · cynap pure (next gen) · cynap videobar +1 more | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110533 | NOISE | 19 | 0 | 25 | 50 | 6.4 | none | none | foliovision | fv flowplayer video player | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107051 | NOISE | 19 | 0 | 25 | 50 | 4.6 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-61645 | NOISE | 19 | 0 | 25 | 50 | 9.1 | 35.3 | none | none | docat-org | docat | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to Docat 1.6.0 or later, which mitigates filename-based path traversal; unrestricted file-type uploads are not established as remediated by that patch. | ||
| CVE-2026-115216 | REVIEW | 19 | 0 | 25 | 50 | 9.1 | 14.6 | none | eclipse foundation | eclipse iofog | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.1 with a fix available is never below REVIEW | Upgrade Eclipse ioFog Operator to 3.9.2 or later, which restores TLS certificate verification. | |||
| CVE-2026-58256 | NOISE | 19 | 0 | 25 | 50 | 9.1 | 47.4 | none | jeromedevome | grr | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to GRR 4.5.0 or later, which fixes the LDAP connector PHP injection. | |||
| CVE-2026-92744 | NOISE | 19 | 6 | 25 | 40 | 8.7 | 17.4 | none | none | delinea | privilege manager | 2026-10-29 | CISA SSVC: total technical impact | Upgrade to Privilege Manager 13.0.2064 for Windows agents above 12.0.5796, or to 12.0.5804 for Windows agents 12.0.5796 or earlier; cloud/on-prem customers unable to upgrade should apply the release-notes mitigations. | ||
| CVE-2026-118984 | NOISE | 19 | 0 | 25 | 50 | 5.5 | 32.1 | none | none | cheaper-inference | omniroute | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-117532 | REVIEW | 19 | 6 | 25 | 40 | 9.8 | 52.4 | none | redaxo | core | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Upgrade REDAXO core to 5.21.4 or later; versions from 5.3.0 before 5.21.4 are affected. | |||
| CVE-2026-47486 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 4.5 | none | none | nvidia | physx | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-113775 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 6.1 | none | none | autodesk | fusion | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-62300 | NOISE | 19 | 0 | 25 | 50 | 6.5 | none | filecoin-project | filecoin-pin | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118246 | NOISE | 19 | 0 | 25 | 50 | 8.4 | 27.2 | none | highcharts | highcharts | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade Highcharts to 11.4.9, 12.6.1, or 13.1.0 or later (the CVE text names 13.1.0; the affected range lists 13.0.0 through 13.1.1). | |||
| CVE-2026-118254 | NOISE | 19 | 0 | 25 | 50 | 8.6 | 36.2 | none | highcharts, @highcharts | highcharts · grid-lite · grid-pro | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade @highcharts/grid-lite and grid-pro to 3.2.0 or later. | |||
| CVE-2026-118255 | NOISE | 19 | 0 | 25 | 50 | 8.4 | 28.5 | none | highcharts, @highcharts | highcharts · dashboards · grid-pro | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to Grid Pro 3.2.0 or later; the fix is included in the grid-v3.2.0 release. | |||
| CVE-2026-99127 | NOISE | 19 | 0 | 70 | 5 | 5.9 | none | linux | linux | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-102814 | NOISE | 19 | 6 | 25 | 40 | 8.7 | 29.7 | none | none | tp-link systems inc. | re305 v3 | 2026-10-27 | CISA SSVC: total technical impact | Update RE305 V3 firmware to 1.1.8 Build 20260921 Rel. 42853 or later, per TP-Link’s download page and FAQ 5362. | ||
| CVE-2026-118253 | NOISE | 19 | 6 | 25 | 40 | 8.4 | 36.2 | none | none | highcharts, @highcharts | highcharts · dashboards | 2026-10-28 | CISA SSVC: total technical impact | Upgrade @highcharts/dashboards to 4.2.3 or later. | ||
| CVE-2026-81038 | NOISE | 19 | 0 | 25 | 50 | 7.1 | none | none | zephyrproject | zephyr | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-81039 | NOISE | 19 | 0 | 25 | 50 | 4.3 | none | none | zephyrproject | zephyr | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118684 | NOISE | 19 | 0 | 25 | 50 | 5.9 | 8.1 | none | project-monai | monai | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57195 | NOISE | 19 | 0 | 25 | 50 | 7.5 | 47.4 | none | asterisk | certified-asterisk | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65629 | NOISE | 19 | 0 | 25 | 50 | 7.4 | 0.0 | none | potatosalad | jose | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-70381 | NOISE | 19 | 0 | 25 | 50 | 5.3 | 17.2 | none | wolfvision | cynap pro, cynap core pro, cynap receiver, cynap pure, cynap pure mini, cynap pure pro · cynap pure (next gen), cynap bridge · cynap videobar +1 more | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112343 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 40.8 | none | none | syncplify, inc. | syncplify server! | 2026-10-26 | CISA SSVC: total technical impact | Upgrade to Syncplify Server! 8.8.0 or later, which fixes the permission override bypass. | ||
| CVE-2026-77062 | NOISE | 19 | 0 | 25 | 50 | 6.9 | none | none | boneio | boneio | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-120040 | NOISE | 19 | 1 | 25 | 50 | 7.5 | none | wardee | mail logging & catcher | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107710 | NOISE | 19 | 0 | 25 | 50 | 6.4 | 10.0 | none | none | wpmudev | hustle – email marketing, lead generation, optins, popups | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-93434 | NOISE | 19 | 0 | 25 | 50 | 8.7 | 39.7 | none | watchguard | fireware os | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to Fireware OS 12.5.22, 2026.4, or 12.12.4 (per the WatchGuard PSIRT advisory for CVE-2026-93434). | |||
| CVE-2026-120197 | NOISE | 19 | 6 | 13 | 50 | 9.9 | none | wavlink | wl-wn530hg4b | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118649 | NOISE | 19 | 6 | 25 | 40 | 8.3 | 19.2 | none | none | n8n-io | n8n | 2026-10-28 | CISA SSVC: total technical impact | Upgrade to n8n 2.43.5 or later, or 2.44.1 or later for the 2.44.x line. | ||
| CVE-2026-120239 | NOISE | 19 | 6 | 13 | 50 | 9.9 | none | wavlink | wn553x1-b | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119428 | NOISE | 19 | 0 | 25 | 50 | 3.7 | none | phpmyadmin | phpmyadmin | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118682 | NOISE | 19 | 0 | 25 | 50 | 7.5 | 19.3 | none | karingx | clashmi | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-63341 | NOISE | 19 | 1 | 25 | 50 | 7.5 | none | moscajs | aedes | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-77058 | NOISE | 19 | 0 | 25 | 50 | 5.1 | none | none | boneio | boneio | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-61725 | NOISE | 19 | 0 | 25 | 50 | 6.1 | none | hasenbanck | sevenz-rust2 | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-63201 | NOISE | 19 | 0 | 25 | 50 | 7.1 | none | cesnet | netopeer2 | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120240 | NOISE | 19 | 6 | 13 | 50 | 9.9 | none | wavlink | wn553x1-b | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119166 | NOISE | 19 | 0 | 25 | 50 | 5.3 | none | uscnanbu | welcart e-commerce | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115904 | NOISE | 19 | 5 | 25 | 40 | 9.6 | 54.7 | none | topluyo | app | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade Topluyo Desktop for Linux to version 2026.9.2410 or later, which patches the issue. | |||
| CVE-2026-61564 | REVIEW | 19 | 1 | 25 | 50 | 10.0 | 45.4 | none | wwbn | avideo-encoder | 2026-10-28 | Unauthenticated remote code execution via the installer endpoint, but only on fresh deployments or where videos/configuration.php is absent; EPSS is 0.005 and no exploitation signal exists yet. | Upgrade AVideo-Encoder to 8.1.0 or later. If you cannot patch immediately, ensure videos/configuration.php exists and is not writable, and block or restrict access to install/checkConfiguration.php at the web server or WAF. | |||
| CVE-2026-116552 | NOISE | 19 | 0 | 25 | 50 | 4.7 | none | none | likebtn | like button rating ♥ likebtn | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118685 | NOISE | 19 | 0 | 25 | 50 | 6.5 | 8.2 | none | tooljet | tooljet | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119980 | NOISE | 19 | 0 | 25 | 50 | 6.5 | none | stiofansisland | userswp – front-end login form, user registration, user profile & members directory plugin for wp | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117685 | NOISE | 19 | 0 | 25 | 50 | 9.6 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116520 | NOISE | 19 | 0 | 25 | 50 | 7.2 | 32.4 | none | none | buildwps | ppwp – password protect pages | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-118251 | NOISE | 19 | 0 | 25 | 50 | 8.4 | 37.6 | none | highcharts | highcharts | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to 11.4.9, 12.6.1 or 13.1.0 or later; the CVE record lists 13.0.0 through 13.1.0 as affected, so use 13.1.1 or later on the 13.x line. | |||
| CVE-2026-118633 | NOISE | 19 | 0 | 70 | 5 | 8.1 | 48.4 | none | sophos | sg utm | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2025-14260 | NOISE | 19 | 6 | 25 | 40 | 8.3 | 20.5 | none | none | wso2 | wso2 api manager · wso2 identity server as key manager · wso2 open banking am +3 more | 2026-10-28 | CISA SSVC: total technical impact | Apply the WSO2-2025-4050 security advisory updates: API Manager 3.1.0.354, 3.2.0.458, 3.2.1.99 or 4.0.0.379 and later; Identity Server as Key Manager 5.10.0.374; Open Banking AM 2.0.0.403. | ||
| CVE-2026-21157 | NOISE | 19 | 6 | 25 | 40 | 8.3 | 1.1 | none | none | samsung mobile | bixby | 2026-10-29 | CISA SSVC: total technical impact | Update Bixby to version 4.0.85.6 or later; versions below 4.0.85.6 are affected. | ||
| CVE-2026-6647 | NOISE | 19 | 0 | 25 | 50 | 7.4 | 11.5 | none | none | wso2 | wso2 identity server · wso2 carbon oauth | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-96432 | NOISE | 19 | 0 | 25 | 50 | 2.1 | none | none | qt | qt | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116212 | NOISE | 19 | 0 | 25 | 50 | 5.4 | none | webasyst | webasyst framework | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113693 | NOISE | 19 | 0 | 25 | 50 | 5.3 | 27.0 | none | none | bmc | bmc it service management suite | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-66092 | NOISE | 19 | 0 | 25 | 50 | 4.8 | 25.7 | none | none | apereo foundation | openequella | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-16889 | NOISE | 19 | 0 | 25 | 50 | 4.8 | 24.4 | none | none | apereo foundation | openequella | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118661 | NOISE | 19 | 0 | 25 | 50 | 6.5 | 19.6 | none | capricorn86 | happy-dom | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119552 | NOISE | 19 | 0 | 25 | 50 | 4.8 | none | none | louislam | uptime-kuma | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119560 | NOISE | 19 | 0 | 25 | 50 | 5.9 | none | none | opnsense | core | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119650 | NOISE | 19 | 0 | 25 | 50 | 5.4 | none | none | hulaspark | hula-server | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119598 | NOISE | 19 | 0 | 25 | 50 | 4.3 | none | none | iluobei | miaomiaowu | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-109231 | NOISE | 19 | 0 | 25 | 50 | 4.3 | 30.9 | none | vendidero | germanized for woocommerce | 2026-10-31 | no exploitation evidence in any monitored source | ||||
| CVE-2023-7357 | NOISE | 19 | 6 | 25 | 40 | 8.6 | 31.9 | none | none | revera | flexnet publisher | 2026-10-29 | CISA SSVC: total technical impact | Upgrade to FlexNet Publisher 2023 R2 (11.19.4.0) or later; versions below 2023 R2 (11.19.4.0), including 2023 R1 (11.19.3.0), are affected. | ||
| CVE-2026-82945 | NOISE | 19 | 0 | 25 | 50 | 6.5 | 6.3 | none | none | rt-labs ab | soem | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116105 | NOISE | 19 | 0 | 25 | 50 | 3.7 | 19.0 | none | none | n/a | heycyan app | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-96554 | NOISE | 19 | 0 | 25 | 50 | 6.4 | 9.8 | none | none | boss media | buddyboss platform | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-108686 | NOISE | 19 | 0 | 25 | 50 | 3.7 | 12.1 | none | none | unknown | wp post author | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-59386 | NOISE | 19 | 3 | 30 | 40 | 6.5 | 14.4 | none | none | cloud foundry | cloud foundry controller (capi) · cf-deployment | 2026-10-30 | CISA SSVC: total technical impact | |||
| CVE-2025-62839 | NOISE | 19 | 6 | 25 | 40 | 8.7 | 15.8 | none | none | qnap systems inc. | hbs 3 hybrid backup sync | 2026-10-29 | CISA SSVC: total technical impact | Upgrade to HBS 3 Hybrid Backup Sync 26.4.0.521 or later, or Hybrid Backup Sync 26.4.0.521 or later (26.4.1.563 or later for the Hybrid Backup Sync line). | ||
| CVE-2026-118657 | NOISE | 19 | 0 | 25 | 50 | 5.9 | 2.8 | none | labstack | echo | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119281 | NOISE | 19 | 0 | 25 | 50 | 5.9 | 20.9 | none | mariadb-corporation | mariadb-connector-j | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107457 | NOISE | 19 | 0 | 25 | 50 | 2.3 | none | qt | qt | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-45049 | NOISE | 19 | 0 | 25 | 50 | 8.3 | 26.4 | none | openidentityplatform | openam | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to OpenAM 16.1.1 or later, which fixes this issue. | |||
| CVE-2026-103370 | NOISE | 19 | 0 | 25 | 50 | 6.4 | 17.2 | none | none | awesomesupport | awesome support – wordpress helpdesk & support plugin | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-118644 | NOISE | 19 | 0 | 25 | 50 | 7.7 | 10.1 | none | n8n-io | n8n | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118642 | NOISE | 19 | 0 | 25 | 50 | 7.1 | 11.5 | none | n8n-io | n8n | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118235 | NOISE | 19 | 6 | 25 | 40 | 9.8 | 54.6 | none | wpazleen | simpleform – form maker to chat apps with quiz, poll and multi lead notifications | 2026-10-31 | no exploitation evidence in any monitored source | ||||
| CVE-2026-106647 | NOISE | 19 | 0 | 25 | 50 | 3.8 | 9.1 | none | none | unknown | royal addons for elementor | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-82961 | NOISE | 19 | 0 | 25 | 50 | 7.8 | 2.5 | none | zephyrproject | zephyr | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116675 | NOISE | 19 | 6 | 25 | 40 | 8.5 | 28.5 | none | none | tinymce | tinymce | 2026-10-27 | CISA SSVC: total technical impact | Upgrade to TinyMCE 8.9.3 or later, or 7.9.4 or later. | ||
| CVE-2026-110910 | NOISE | 19 | 0 | 25 | 50 | 3.7 | 21.2 | none | ljharb | qs | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116674 | NOISE | 19 | 0 | 25 | 50 | 6.5 | 21.3 | none | sebhildebrandt | systeminformation | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117604 | NOISE | 19 | 0 | 25 | 50 | 7.5 | 23.5 | none | getgrav | grav | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57196 | NOISE | 19 | 0 | 25 | 50 | 2.3 | 55.5 | none | none | asterisk | certified-asterisk | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-117472 | NOISE | 19 | 0 | 25 | 50 | 4.3 | 25.3 | none | esaqa gmbh | psono | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82117 | REVIEW | 19 | 6 | 25 | 40 | 9.8 | 50.8 | none | hitachi | hirdb server version 10 · hirdb server version 9(32) · hirdb server with additional function version 9(32) | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Upgrade HiRDB Server Version 10 to 10-12-01 or later; for Version 9, apply the fixed release named in Hitachi advisory hitachi-sec-2026-149. | |||
| CVE-2026-117614 | NOISE | 19 | 0 | 25 | 50 | 11.5 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-88942 | NOISE | 19 | 0 | 25 | 50 | 6.1 | 19.4 | none | none | woobewoo | product filter for woocommerce by wbw | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-116612 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 14.0 | none | none | gstreamer project | gst-editing-services | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-120227 | NOISE | 19 | 6 | 13 | 50 | 9.9 | none | wavlink | wn701ae | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-55551 | NOISE | 19 | 0 | 25 | 50 | 6.5 | none | infonl | dimpact-zaakafhandelcomponent | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119123 | NOISE | 19 | 0 | 25 | 50 | 3.7 | none | imagemagick | imagemagick | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107895 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 2.3 | none | none | fuji electric co., ltd. / hakko electronics co., ltd. | v-sft | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-107894 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 3.3 | none | none | fuji electric co., ltd. / hakko electronics co., ltd. | v-sft | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-50095 | NOISE | 19 | 0 | 25 | 50 | 6.1 | none | none | esri | arcgis server | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117681 | NOISE | 19 | 0 | 25 | 50 | 8.0 | 0.7 | none | affected product not stated | 2026-10-31 | no exploitation evidence in any monitored source | No fix is available; Red Hat states no mitigation meets its criteria for ease of use, deployment applicability or stability. | ||||
| CVE-2026-115805 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 6.0 | none | none | rapid7 | insight agent | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-115533 | NOISE | 19 | 0 | 25 | 50 | 27.8 | none | hugging face | lerobot | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119342 | NOISE | 19 | 0 | 25 | 50 | 5.3 | none | stirling-tools | stirling-pdf | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-62863 | NOISE | 19 | 5 | 0 | 65 | 9.6 | none | gojue | moling | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to MoLing 0.5.0 or later, which fixes the unauthenticated SSE endpoints and permissive CORS behavior. | ||||
| CVE-2026-62965 | NOISE | 19 | 0 | 25 | 50 | 7.0 | none | sabnzbd | sabnzbd | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-55146 | NOISE | 19 | 0 | 25 | 50 | 4.3 | none | aces | loris | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-55147 | NOISE | 19 | 0 | 25 | 50 | 6.3 | none | aces | loris | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118952 | NOISE | 19 | 0 | 25 | 50 | 6.5 | none | red hat | streams for apache kafka 2 · streams for apache kafka 3 | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105031 | NOISE | 19 | 0 | 25 | 50 | 2.9 | none | apache software foundation | apache qpid proton c | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-63402 | NOISE | 19 | 0 | 25 | 50 | 5.9 | none | i18next | i18next | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117624 | NOISE | 19 | 0 | 25 | 50 | 9.1 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119250 | NOISE | 19 | 5 | 25 | 40 | 7.8 | 21.6 | none | none | ubiquiti inc | wifiman desktop | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-112255 | NOISE | 19 | 0 | 25 | 50 | 2.9 | 40.6 | none | opentext | advanced authentication server | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-66912 | NOISE | 19 | 0 | 25 | 50 | 5.3 | 40.4 | none | synacor | zimbra collaboration | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111732 | REVIEW | 19 | 0 | 25 | 50 | 9.3 | 34.6 | none | rt-labs | p-net | 2026-10-29 | floor: pre-auth, no-user-interaction CVSS 9.3 with a fix available is never below REVIEW | Upgrade to P-Net 1.0.3 or later. | |||
| CVE-2026-118757 | NOISE | 19 | 0 | 25 | 50 | 6.5 | 14.0 | none | pi websolution | piweb disable payment method / partial payment for woocommerce | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-44179 | NOISE | 19 | 6 | 25 | 40 | 9.9 | 52.8 | none | xwikisas | xwiki-pro-macros | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade xwiki-pro-macros to version 1.14.5 or later. | |||
| CVE-2026-118259 | NOISE | 19 | 0 | 25 | 50 | 5.3 | 42.2 | none | open-telemetry | opentelemetry-java | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-90867 | NOISE | 19 | 5 | 25 | 40 | 8.1 | 34.6 | none | none | progress software | ws_ftp server | 2026-10-29 | CISA SSVC: total technical impact | Restrict network-level access to the Web Admin console to trusted administrative hosts and networks; contact Progress Software Technical Support for mitigation guidance. | ||
| CVE-2026-116634 | NOISE | 19 | 0 | 25 | 50 | 5.9 | none | none | cheaper-inference | omniroute | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-84177 | NOISE | 19 | 0 | 25 | 50 | 6.3 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115720 | NOISE | 18 | 0 | 30 | 40 | 5.0 | none | none | frappe | builder | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-90872 | NOISE | 18 | 3 | 25 | 40 | 6.6 | 21.4 | none | none | progress software | ws_ftp server | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-116865 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 22.7 | none | none | gesundheit bewegt gmbh | zippy | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-111070 | NOISE | 18 | 0 | 33 | 40 | 5.4 | 12.7 | none | none | pluginever | content pilot – autoblogging & affiliate marketing suite | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-116869 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 22.7 | none | none | mypos payments | mypos checkout | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-118074 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 22.7 | none | none | daman jeet | finale lite | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-118077 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 22.7 | none | none | fast themes | sastra essential addons for elementor | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-103882 | NOISE | 18 | 4 | 25 | 40 | 9.1 | 56.2 | none | acadlix | acadlix lms – ai quiz maker, online exam & course plugin for wordpress | 2026-10-31 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119130 | NOISE | 18 | 0 | 33 | 40 | 2.6 | 14.7 | none | none | bytecodealliance | wasmtime | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-120229 | NOISE | 18 | 4 | 13 | 50 | 9.1 | none | wavlink | wn553x1-b | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115590 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 22.7 | none | none | wedevs | dokan | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-116826 | NOISE | 18 | 0 | 30 | 40 | 6.8 | 15.3 | none | none | yeswiki | yeswiki | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-107759 | NOISE | 18 | 0 | 30 | 40 | 7.2 | 19.6 | none | none | wpo365 | wpo365 | microsoft 365 graph mailer | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-119712 | NOISE | 18 | 0 | 30 | 40 | 6.4 | none | pipeshub-ai | pipeshub-ai | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-103392 | NOISE | 18 | 0 | 33 | 40 | 4.8 | 12.0 | none | juniper networks | session smart router | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116680 | NOISE | 18 | 0 | 30 | 40 | 6.4 | 8.7 | none | sysadminsmedia | homebox | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116810 | NOISE | 18 | 0 | 30 | 40 | 5.3 | 16.3 | none | openpanel-dev | openpanel | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116676 | NOISE | 18 | 0 | 30 | 40 | 8.8 | 40.3 | none | runatlantis | atlantis | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to Atlantis 0.47.1 or later; versions 0.4.0 through 0.47.0 are affected. | |||
| CVE-2026-57203 | NOISE | 18 | 3 | 25 | 40 | 6.9 | 3.8 | none | none | asterisk | certified-asterisk | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-59396 | NOISE | 18 | 0 | 30 | 40 | 4.9 | 21.2 | none | none | cloud foundry | uaa · cf-deployment | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2013-20009 | NOISE | 18 | 0 | 33 | 40 | 4.8 | 12.9 | none | linksys | wag200g | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-103393 | NOISE | 18 | 0 | 33 | 40 | 4.3 | 4.5 | none | juniper networks | session smart router | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-63414 | NOISE | 18 | 1 | 30 | 40 | 7.6 | none | shopify | shopify_app | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116864 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 22.7 | none | none | arni cinco | wpcargo track & trace | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-18800 | NOISE | 18 | 0 | 33 | 40 | 4.4 | none | wso2 | wso2 api manager · wso2 traffic manager · wso2 api control plane +5 more | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-103310 | NOISE | 18 | 0 | 33 | 40 | 5.3 | none | unknown | payhere payment gateway | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120343 | NOISE | 18 | 0 | 30 | 40 | 4.3 | none | mathurvishal | cloudclassroom-php-project | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120342 | NOISE | 18 | 1 | 30 | 40 | 7.3 | none | mathurvishal | cloudclassroom-php-project | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120341 | NOISE | 18 | 1 | 30 | 40 | 7.3 | none | mathurvishal | cloudclassroom-php-project | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120340 | NOISE | 18 | 0 | 30 | 40 | 3.7 | none | mathurvishal | cloudclassroom-php-project | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-82840 | NOISE | 18 | 0 | 33 | 40 | 7.2 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120242 | NOISE | 18 | 0 | 30 | 40 | 2.4 | none | ruijie | rg-es205gc · rg-es206gc-p · rg-es208gc +2 more | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119663 | NOISE | 18 | 0 | 30 | 40 | 4.3 | none | wannabespace | tamery | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-103593 | NOISE | 18 | 3 | 25 | 40 | 7.1 | 0.8 | none | none | watchguard | fireware os | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-102815 | NOISE | 18 | 3 | 25 | 40 | 6.9 | 48.6 | none | none | tp-link systems inc. | re305 v3 | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-93862 | NOISE | 18 | 0 | 33 | 40 | 7.2 | 5.7 | none | none | watchguard | fireware os | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-103400 | NOISE | 18 | 0 | 33 | 40 | 5.5 | 7.2 | none | none | juniper networks | session smart router · session smart conductor | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-104381 | NOISE | 18 | 0 | 33 | 40 | 6.0 | 2.8 | none | watchguard | fireware os | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110133 | NOISE | 18 | 3 | 25 | 40 | 5.8 | 14.5 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-30 | CISA SSVC: total technical impact | |||
| CVE-2026-119343 | NOISE | 18 | 0 | 30 | 40 | 6.8 | none | stirling-tools | stirling-pdf | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118376 | NOISE | 18 | 0 | 30 | 40 | 5.3 | 19.7 | none | none | tencent | weknora | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-116896 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 12.9 | none | none | redaxo | core | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-62303 | NOISE | 18 | 0 | 33 | 40 | 5.9 | none | pistacheio | pistache | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-11587 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 18.3 | none | none | centreon | centreon | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-115418 | NOISE | 18 | 1 | 30 | 40 | 7.3 | none | aws | aws-cdk/aws-redshift-alpha | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-85297 | NOISE | 18 | 1 | 30 | 40 | 7.7 | none | google cloud | cloud run mcp | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-59385 | NOISE | 18 | 0 | 30 | 40 | 2.7 | 8.5 | none | none | cloud foundry | capi (cloud foundry controller) · cf deployment | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-118071 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 4.4 | none | none | unknown | joinchat | 2026-10-30 | CISA SSVC: total technical impact | |||
| CVE-2026-118165 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 4.4 | none | none | unknown | firelight lightbox | 2026-10-30 | CISA SSVC: total technical impact | |||
| CVE-2026-116566 | NOISE | 18 | 3 | 25 | 40 | 5.3 | 17.7 | none | none | python software foundation | cpython | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-90464 | NOISE | 18 | 0 | 33 | 40 | 7.2 | 30.3 | none | watchguard | fireware os | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-61654 | NOISE | 18 | 0 | 30 | 40 | 8.3 | 32.0 | none | lightdash | lightdash | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to Lightdash 0.3214.0 or later, which fixes the identifier path traversal and verifies webhook HMAC signatures when a secret is configured. | |||
| CVE-2026-90861 | NOISE | 18 | 3 | 25 | 40 | 6.6 | 23.3 | none | none | progress software | ws_ftp server | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-3322 | NOISE | 18 | 3 | 25 | 40 | 5.6 | 7.9 | none | none | lobster data gmbh | lobster_pro | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-110475 | NOISE | 18 | 15 | 13 | 30 | 9.3 | none | creditnirvana | creditnirvana collections platform (collectionworkz) | 2026-10-26 | no exploitation evidence in any monitored source | Upgrade CreditNirvana Collections Platform to version 4.8.2 or later; all versions prior to 4.8.2 are affected. | ||||
| CVE-2026-118643 | NOISE | 18 | 0 | 30 | 40 | 8.2 | 17.2 | none | n8n-io | n8n | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to n8n 1.123.85 or later, 2.43.5 or later, or 2.44.1 or later. | |||
| CVE-2026-103394 | NOISE | 18 | 0 | 33 | 40 | 3.7 | 24.4 | none | none | juniper networks | session smart router | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-104384 | NOISE | 18 | 0 | 33 | 40 | 8.7 | 36.9 | none | eaglecloud | aquila | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-120339 | NOISE | 18 | 0 | 30 | 40 | 4.3 | none | mathurvishal | cloudclassroom-php-project | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120310 | NOISE | 18 | 0 | 30 | 40 | 3.1 | none | parse-community | parse-server | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109386 | NOISE | 18 | 0 | 30 | 40 | 4.3 | none | wpmudev | hustle – email marketing, lead generation, optins, popups | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-21830 | NOISE | 18 | 0 | 30 | 40 | 3.7 | 16.3 | none | hcl software | bigfix aex | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-120278 | NOISE | 18 | 0 | 33 | 40 | 5.3 | none | wavlink | wn536ax6-a | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116808 | NOISE | 18 | 0 | 30 | 40 | 7.2 | 32.5 | none | openpanel-dev | openpanel | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115413 | NOISE | 18 | 0 | 30 | 40 | 7.8 | 0.7 | none | aws | aws-api-mcp-server | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-71455 | NOISE | 18 | 0 | 30 | 40 | 5.3 | none | johnson controls | kantech entrapass | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115717 | NOISE | 18 | 1 | 30 | 40 | 7.7 | none | frappe | builder | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110505 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 33.2 | none | none | unknown | enable svg, webp, and ico upload | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-88967 | NOISE | 18 | 0 | 30 | 40 | 7.7 | 21.6 | none | grafana | grafana enterprise · grafana oss | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115301 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 36.5 | none | none | unknown | contact form by supsystic | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-115495 | NOISE | 18 | 0 | 33 | 40 | 5.7 | 0.1 | none | watchguard | mobile vpn with ssl client | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-120311 | NOISE | 18 | 4 | 0 | 65 | 8.8 | none | jovancoding | network-ai | 2026-11-02 | no exploitation evidence in any monitored source | Upgrade Network-AI to 5.15.5 or later; versions from 5.13.4 before 5.15.5 are affected. | ||||
| CVE-2026-109381 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 37.4 | none | none | magepeopleteam | event booking manager for woocommerce – sell tickets, event registration, rsvp & event calendar | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-116390 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 22.7 | none | none | stepasyuk | filter everything — wordpress & woocommerce filters | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-116827 | NOISE | 18 | 0 | 30 | 40 | 6.8 | 28.0 | none | yeswiki | yeswiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110504 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 21.6 | none | none | unknown | enable svg, webp, and ico upload | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-118760 | NOISE | 18 | 0 | 30 | 40 | 6.5 | 28.8 | none | kubeflow | pipelines | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-103408 | NOISE | 18 | 0 | 33 | 40 | 8.8 | 23.7 | none | juniper networks | session smart router | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade Session Smart Router to 7.0.5, 7.1.7, 7.2.3 or later; no workarounds are available. | |||
| CVE-2026-85299 | NOISE | 18 | 0 | 30 | 40 | 8.3 | 17.1 | none | google cloud | compute engine | 2026-10-27 | no exploitation evidence in any monitored source | Google patched this server-side on 31 August 2026; no customer action is required. | |||
| CVE-2026-110952 | NOISE | 18 | 0 | 30 | 40 | 2.0 | none | apache software foundation | apache kafka | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-93757 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 36.7 | none | none | wild-apricot | wild apricot login | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-111739 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 21.2 | none | none | unknown | two factor authentication · all-in-one security (aios) | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-116392 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 22.7 | none | none | pickplugins | accordion | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-118677 | NOISE | 18 | 0 | 33 | 40 | 5.9 | 5.7 | none | n8n-io | n8n | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117568 | NOISE | 18 | 3 | 25 | 40 | 7.0 | 48.5 | none | none | bitscorp-mcp | mcp-ffmpeg | 2026-10-27 | CISA SSVC: total technical impact | |||
| CVE-2026-119115 | NOISE | 18 | 0 | 30 | 40 | 8.5 | 6.4 | none | aws | aws-privateca-issuer | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade aws-privateca-issuer to v1.10.1 or the EKS add-on to v1.10.1-eksbuild.1, and correct any issuerRef.kind that is missing, incorrect, or mismatched, since v1.10.1 requires it to be exactly AWSPCAIssuer or AWSPCAClu | |||
| CVE-2026-112351 | NOISE | 18 | 4 | 25 | 40 | 8.8 | 85.8 | none | sunhillo corporation | sureline | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade SureLine to 9.1.5 or later; versions before 9.1.5 are affected. | |||
| CVE-2026-120312 | NOISE | 18 | 4 | 0 | 65 | 8.8 | none | jovancoding | network-ai | 2026-11-02 | no exploitation evidence in any monitored source | Upgrade Network-AI to 5.15.5 or later; versions from 5.13.4 before 5.15.5 are affected. | ||||
| CVE-2026-92171 | NOISE | 18 | 0 | 33 | 40 | 6.5 | none | red hat | red hat data grid 8 | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-63115 | NOISE | 18 | 0 | 30 | 40 | 5.3 | none | tryghost | activitypub | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107059 | NOISE | 18 | 0 | 33 | 40 | 9.9 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-103391 | NOISE | 18 | 0 | 33 | 40 | 5.3 | 10.8 | none | juniper networks | session smart router | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79589 | NOISE | 18 | 0 | 33 | 40 | 7.2 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-42701 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 30.9 | none | none | yaycommerce | yaymail | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-118244 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 27.1 | none | none | highcharts | highcharts | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-118079 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 22.7 | none | none | foliovision | fv flowplayer video player | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-118078 | NOISE | 18 | 3 | 25 | 40 | 7.2 | 22.7 | none | none | pixelyoursite | product catalog feed by pixelyoursite | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-92092 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 15.1 | none | none | red hat | red hat openshift container platform 4 · red hat openshift container platform 5 | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-61576 | NOISE | 18 | 0 | 30 | 40 | 8.3 | 39.0 | none | none | lightdash | lightdash | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to Lightdash 0.3214.0 or later, which fixes identifier path traversal and verifies webhook HMAC signatures when a secret is configured. | ||
| CVE-2026-82389 | NOISE | 18 | 0 | 33 | 40 | 6.5 | none | none | zephyrproject | zephyr | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82388 | NOISE | 18 | 0 | 33 | 40 | 5.3 | none | none | zephyrproject | zephyr | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57448 | NOISE | 18 | 0 | 30 | 40 | 6.2 | 27.7 | none | mrblomblo | blombooru | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117494 | NOISE | 18 | 0 | 30 | 40 | 8.3 | 20.9 | none | sisense | cloud bi platform | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117493 | NOISE | 18 | 0 | 30 | 40 | 8.3 | 20.9 | none | sisense | cloud bi platform | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112362 | REVIEW | 18 | 0 | 33 | 40 | 9.1 | 30.3 | none | @fastify/express | @fastify/express | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.1 with a fix available is never below REVIEW | Upgrade @fastify/express to 4.0.9 or later; alternatively enforce authentication in a Fastify preHandler hook or leave ignoreDuplicateSlashes at its default. | |||
| CVE-2026-61529 | NOISE | 18 | 0 | 30 | 40 | 4.7 | 10.7 | none | none | endatix | endatix | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-119337 | NOISE | 18 | 0 | 30 | 40 | 7.1 | none | infiniflow | ragflow | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111590 | NOISE | 18 | 0 | 30 | 40 | none | harbor | harbor | 2026-10-26 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-119027 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 33.6 | none | none | oapi-codegen | oapi-codegen | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-116234 | NOISE | 18 | 5 | 13 | 50 | 9.1 | 39.7 | none | oray | pugongying x5 pro | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116488 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 31.4 | none | none | nxp | mcuxsdk-middleware-usb | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-110524 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 24.6 | none | none | unknown | copy anything to clipboard for wordpress | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-55098 | NOISE | 18 | 0 | 30 | 40 | 6.5 | none | basekick-labs | arc | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115683 | NOISE | 18 | 15 | 25 | 15 | 6.8 | 12.6 | poc | poc_early | gnome | epiphany | 2026-10-30 | CISA SSVC: public proof of concept; CISA SSVC: total technical impact | |||
| CVE-2026-105972 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 21.7 | none | none | unknown | menu cart for woocommerce | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-103411 | NOISE | 18 | 0 | 33 | 40 | 7.1 | 6.9 | none | juniper networks | session smart router | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116812 | NOISE | 18 | 0 | 30 | 40 | 6.5 | 14.3 | none | openpanel-dev | openpanel | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115425 | NOISE | 18 | 0 | 33 | 40 | 5.6 | 20.8 | none | none | opnsense | opnsense firewall | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-118992 | NOISE | 18 | 3 | 0 | 65 | 8.4 | none | none | affected product not stated | 2026-10-30 | CISA SSVC: total technical impact | Upgrade to CallBackery 0.62.0 or later. | ||||
| CVE-2026-113487 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 24.6 | none | none | unknown | geodirectory | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-110506 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 24.6 | none | none | unknown | page builder by siteorigin | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-63224 | NOISE | 18 | 0 | 30 | 40 | 7.2 | none | openremote | openremote | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118185 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 7.8 | none | none | unknown | security optimizer | 2026-10-31 | CISA SSVC: total technical impact | |||
| CVE-2026-103407 | NOISE | 18 | 0 | 33 | 40 | 8.8 | 13.8 | none | juniper networks | session smart router · session smart conductor | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to Session Smart Router or Conductor 7.0.5, 7.1.7, 7.2.3 or later; no workarounds are available. | |||
| CVE-2026-113881 | NOISE | 18 | 0 | 33 | 40 | 6.1 | 29.3 | none | watchguard | fireware os | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111967 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 24.6 | none | none | unknown | mp3 audio player | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-113482 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 4.4 | none | none | unknown | media library assistant | 2026-11-01 | CISA SSVC: total technical impact | |||
| CVE-2026-84296 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 27.3 | none | none | progress software | ws_ftp server | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-103402 | NOISE | 18 | 0 | 33 | 40 | 8.8 | 9.4 | none | juniper networks | session smart router · session smart conductor | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to Session Smart Router or Session Smart Conductor 7.0.5, 7.1.7, 7.2.3 or later; no workarounds are available. | |||
| CVE-2026-116813 | NOISE | 18 | 0 | 30 | 40 | 6.5 | 14.3 | none | none | openpanel-dev | openpanel | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-119251 | NOISE | 18 | 3 | 25 | 40 | 6.7 | 3.9 | none | none | ubiquiti inc | wifiman desktop for macos | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-118905 | NOISE | 18 | 0 | 33 | 40 | 7.0 | 3.2 | none | nvm-sh | nvm | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113488 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 24.6 | none | none | unknown | geodirectory | 2026-10-28 | CISA SSVC: total technical impact | |||
| CVE-2026-103401 | NOISE | 18 | 0 | 33 | 40 | 8.8 | 28.0 | none | juniper networks | session smart router · session smart conductor | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to Session Smart Router/Conductor 7.0.5, 7.1.7, 7.2.3 or later; no workarounds are available. | |||
| CVE-2026-118665 | NOISE | 18 | 0 | 30 | 40 | 8.2 | 32.9 | none | ardatan, @graphql-tools | graphql-tools · executor-legacy-ws | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade @graphql-tools/executor-legacy-ws to 1.1.36 or later (graphql-tools 9.0.36 or later). | |||
| CVE-2026-119664 | NOISE | 18 | 0 | 30 | 40 | 4.3 | none | wannabespace | tamery | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-103405 | NOISE | 18 | 0 | 33 | 40 | 5.8 | 13.3 | none | juniper networks | session smart router · session smart conductor | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-42949 | NOISE | 18 | 3 | 25 | 40 | 5.6 | 12.7 | none | none | frangoteam | frangoteam | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-119148 | NOISE | 18 | 0 | 30 | 40 | 6.5 | none | none | aws | aws-nitro-enclaves-sdk-c | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118765 | NOISE | 18 | 4 | 25 | 40 | 7.3 | 3.7 | none | none | randombit | botan | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-59388 | NOISE | 18 | 0 | 30 | 40 | 6.5 | 22.6 | none | none | cloud foundry foundation | capi (cloud foundry controller) · cf-deployment | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-119117 | NOISE | 18 | 0 | 30 | 40 | 6.5 | none | none | aws | amazon-kinesis-producer | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-59979 | NOISE | 18 | 0 | 33 | 40 | 8.3 | 22.1 | none | yosemitecrew | yosemite-crew | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118438 | NOISE | 18 | 3 | 25 | 40 | 6.8 | 5.6 | none | none | unknown | firelight lightbox | 2026-10-31 | CISA SSVC: total technical impact | |||
| CVE-2026-118258 | NOISE | 18 | 0 | 30 | 40 | 3.7 | 20.6 | none | i18next | i18next-http-backend | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119566 | NOISE | 18 | 0 | 30 | 40 | 4.8 | none | prometheus | prometheus | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110732 | NOISE | 18 | 4 | 25 | 40 | 7.5 | 19.7 | none | none | tigroumeow | ai engine – mcp server & ai chatbot for wordpress, with claude, chatgpt & gemini | 2026-10-30 | CISA SSVC: total technical impact | |||
| CVE-2026-116248 | NOISE | 18 | 0 | 33 | 40 | 6.8 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-15564 | NOISE | 18 | 4 | 25 | 40 | 7.4 | 2.1 | none | none | red hat | red hat jboss enterprise application platform 7 · red hat jboss enterprise application platform 8 | 2026-10-29 | CISA SSVC: total technical impact | |||
| CVE-2026-116543 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | open5gs | open5gs | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116218 | NOISE | 17 | 1 | 25 | 40 | 7.6 | none | dolibarr | dolibarr | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119719 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | blender foundation | blender | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-22110 | NOISE | 17 | 11 | 0 | 45 | 8.7 | none | none | delta electronics | delta ufc500 | 2026-10-30 | CISA SSVC: total technical impact | Update the msi-image component to 2.4.18 or later and the ECP component to 4.4.1 or later. | |||
| CVE-2026-120336 | NOISE | 17 | 1 | 25 | 40 | 7.3 | none | vstarcam | o-kam client | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116489 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | timescale | pgvectorscale | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76939 | REVIEW | 17 | 1 | 25 | 40 | 9.8 | 44.1 | none | hitachi | jp1/automatic job management system 3 – manager · jp1/automatic job management system 3 – agent | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Update JP1/Automatic Job Management System 3 Manager and Agent to 13-50-31 or later (fixed builds also at 12-60-53 and 11-50-39); see Hitachi SEC-2026-143. | |||
| CVE-2026-82956 | NOISE | 17 | 1 | 25 | 40 | 7.6 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-62848 | NOISE | 17 | 1 | 25 | 40 | 7.3 | none | metalama | metalama | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119335 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | pi-hole | pi-hole | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-83559 | NOISE | 17 | 1 | 25 | 40 | 7.4 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120313 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | jovancoding | network-ai | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120314 | NOISE | 17 | 1 | 25 | 40 | 7.3 | none | jovancoding | network-ai | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-62297 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | agamnentzar | ag-psd | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115908 | NOISE | 17 | 1 | 25 | 40 | 7.4 | none | none | zip-rs | zip2 | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119656 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | coreunion | coreshop | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119655 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | coreunion | coreshop | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2025-68393 | NOISE | 17 | 11 | 0 | 45 | 8.4 | none | none | arketeam | protectelmaj · bdf | 2026-10-30 | CISA SSVC: total technical impact | Fixed in PROTECTELMAJ v6.5.19 and BDF v6.4.67; upgrade to those versions or later. | |||
| CVE-2026-120337 | NOISE | 17 | 1 | 25 | 40 | 7.3 | none | vstarcam | o-kam superipcam | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111089 | NOISE | 17 | 1 | 25 | 40 | 7.6 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120347 | NOISE | 17 | 1 | 25 | 40 | 7.3 | none | dayrui | xunruicms | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120348 | NOISE | 17 | 1 | 25 | 40 | 7.3 | none | dayrui | xunruicms | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120205 | NOISE | 17 | 12 | 13 | 30 | 8.0 | none | thelia | thelia core | 2026-10-31 | no exploitation evidence in any monitored source | Upgrade to Thelia 3.1.0 or later, which contains the fix for the unescaped customer name in ForSomeCustomers::getSummary(). | ||||
| CVE-2026-110474 | NOISE | 17 | 13 | 13 | 30 | 8.7 | none | creditnirvana | agentic ai call centre | 2026-10-26 | no exploitation evidence in any monitored source | Upgrade CreditNirvana Agentic AI Call Centre to version 2.0.0 or later; all versions prior to 2.0.0 are affected. | ||||
| CVE-2026-114595 | REVIEW | 17 | 1 | 25 | 40 | 9.8 | 43.0 | none | the epics community | epics base | 2026-10-27 | Pre-authentication, no-user-interaction integer overflow in EPICS Base network request handling (CVSS 9.8) with potential RCE, but EPICS is niche control-system software and no exploitation signal exists yet. | Update EPICS Base to 7.0.11 (7.0.10 and earlier affected) and restart the service. Where upgrade must wait, restrict network access to the affected request path to trusted control-network hosts only. | |||
| CVE-2026-62966 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | esp32async | espasyncwebserver | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119760 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | dlundquist | sniproxy | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119025 | NOISE | 17 | 1 | 25 | 40 | 7.5 | 73.3 | none | sindresorhus, modelcontextprotocol | inspector · opencode | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116755 | NOISE | 17 | 1 | 25 | 40 | 7.4 | none | softiron | hypercloud | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-18450 | NOISE | 17 | 1 | 25 | 40 | 9.8 | 34.3 | none | smci | x12spi | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101186 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | huawei | harmonyos | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117559 | NOISE | 17 | 2 | 25 | 40 | 7.8 | 52.6 | none | hyperb1iss | droidmind | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-103963 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119333 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | jgraph | drawio-desktop | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-61567 | REVIEW | 17 | 1 | 25 | 40 | 10.0 | 44.5 | none | wwbn | avideo-encoder | 2026-10-28 | Unauthenticated remote command execution in AVideo-Encoder’s live-streaming endpoint, reachable over the internet with no credentials and no user interaction. EPSS is low (0.00525) and no exploitation signal exists yet, so this is a patch-before-attention item rather than an active incident. | Upgrade AVideo-Encoder to 8.1.0 or later, which fixes the unauthenticated auth-bypass and command-injection path in view/videosListToLive.php. If you cannot upgrade immediately, restrict the encoder endpoint to trusted networks or place it behind a VPN/WAF and rotate stored streamer and database credentials. | |||
| CVE-2026-46560 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | openidentityplatform | openam | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-86574 | REVIEW | 17 | 1 | 25 | 40 | 9.8 | 44.1 | none | hitachi | jp1/base | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Upgrade JP1/Base to 12-50-54 or later; the 11-50 branch is fixed starting from 11-50-36. | |||
| CVE-2026-116243 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117573 | NOISE | 17 | 2 | 25 | 40 | 7.8 | 53.2 | none | masc-ucsc | hagent | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117567 | NOISE | 17 | 2 | 25 | 40 | 7.8 | 51.3 | none | horw | esp-mcp | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-120349 | NOISE | 17 | 1 | 25 | 40 | 7.3 | none | dayrui | xunruicms | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-62864 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | ring-clojure | ring | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117561 | NOISE | 17 | 2 | 25 | 40 | 7.8 | 51.3 | none | codefriar | sf-mcp | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112347 | NOISE | 17 | 1 | 25 | 40 | 7.6 | none | none | themeum | kirki | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117511 | NOISE | 17 | 1 | 25 | 40 | 7.3 | 76.3 | none | desmondmorris | node-tesseract | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119619 | NOISE | 17 | 1 | 25 | 40 | 7.3 | none | 37954679 | cak-filemanagement-system | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120191 | NOISE | 17 | 1 | 25 | 40 | 7.3 | none | n/a | presenton | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112350 | NOISE | 17 | 1 | 25 | 40 | 7.5 | 61.2 | none | sunhillo corporation | sureline | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-71456 | NOISE | 17 | 0 | 18 | 50 | 8.5 | none | johnson controls | kantech entrapass | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-104016 | NOISE | 17 | 1 | 25 | 40 | 7.5 | 52.4 | none | fasterxml | jackson-dataformat-protobuf | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-62958 | NOISE | 17 | 2 | 25 | 40 | 7.9 | none | libriscv | libriscv | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-103406 | REVIEW | 17 | 1 | 25 | 40 | 9.8 | 43.9 | none | juniper networks | session smart conductor | 2026-10-28 | floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Upgrade Session Smart Conductor to 7.0.5, 7.1.7, 7.2.3 or later; no workarounds are available. | |||
| CVE-2026-117569 | NOISE | 17 | 2 | 25 | 40 | 7.8 | 51.8 | none | alishahid74 | kali-gpt | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105765 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | hashicorp | consul enterprise | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-65145 | NOISE | 17 | 1 | 25 | 40 | 10.0 | 44.6 | none | nvidia | nemo agent toolkit | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82120 | REVIEW | 17 | 1 | 25 | 40 | 9.8 | 30.2 | none | hitachi | hirdb server version 10 · hirdb server version 9(32) · hirdb server with additional function version 9(32) | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Upgrade HiRDB Server Version 10 to 10-12-01 or later; for Version 9 releases, apply the fixed build named in Hitachi advisory hitachi-sec-2026-147. | |||
| CVE-2026-116584 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | lxsmnsyc | seroval | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116580 | NOISE | 17 | 1 | 25 | 40 | 7.3 | none | lxsmnsyc | seroval | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120208 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | strukturag | libheif | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116576 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | sebhildebrandt | systeminformation | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76934 | REVIEW | 17 | 1 | 25 | 40 | 9.8 | 44.1 | none | hitachi | jp1/automatic job management system 3 – manager · jp1/automatic job management system 3 – agent minimal edition | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Upgrade to JP1/Automatic Job Management System 3 version 13-50-31 or later (or the 12-60-53 / 11-50-39 maintenance releases); see Hitachi SEC-2026-140. | |||
| CVE-2026-119373 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | sqlite | sqlite | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-82116 | REVIEW | 17 | 1 | 25 | 40 | 9.8 | 49.0 | none | hitachi | hirdb server version 10 · hirdb server version 9(32) · hirdb server with additional function version 9(32) | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Upgrade HiRDB Server Version 10 to 10-12-01 or later (10-11-02 and 10-08-05 also listed as fixed); Version 9 fixes are described in Hitachi advisory hitachi-sec-2026-148. | |||
| CVE-2026-119163 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | teamfunnelkit | funnelkit automations – email marketing automation and crm for wordpress & woocommerce | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-104061 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | scribus | scribus | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-104064 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | scribus | scribus | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-104065 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | scribus | scribus | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-104615 | NOISE | 17 | 2 | 25 | 40 | 7.9 | none | suse | rancher | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-90885 | NOISE | 17 | 13 | 25 | 15 | 7.5 | none | none | apache software foundation | apache camel | 2026-10-26 | CISA SSVC: automatable | ||||
| CVE-2026-117558 | NOISE | 17 | 2 | 25 | 40 | 7.8 | none | ai-sdlc-framework | ai-sdlc | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119716 | NOISE | 17 | 2 | 13 | 50 | 8.1 | none | wbond | pybars3 | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-62264 | NOISE | 17 | 1 | 25 | 40 | 7.5 | none | sylphxai | pdf-reader-mcp | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-82118 | REVIEW | 17 | 1 | 25 | 40 | 9.8 | 44.1 | none | hitachi | hirdb server version 10 · hirdb server version 9(32) · hirdb server with additional function version 9(32) | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.8 with a fix available is never below REVIEW | Upgrade HiRDB Server Version 10 to 10-12-01 or later; for Version 9 releases, apply the fixed build named in Hitachi security advisory hitachi-sec-2026-147. | |||
| CVE-2026-62055 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | liquid web / stellarwp | event tickets | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119367 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | liquid web / stellarwp | the events calendar | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118777 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 17.2 | none | none | digitalbazaar | forge | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118698 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 25.1 | none | none | beardev | joomsport – for sports: team & league, football, hockey & more | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2025-68392 | NOISE | 16 | 0 | 25 | 40 | 5.1 | none | none | arketeam | protectelmaj · bdf | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65444 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | creative themes | blocksy companion | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117562 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | anyant | rssant | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116685 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 34.1 | none | none | modelcontextprotocol | python-sdk | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-116582 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 8.4 | none | none | lxsmnsyc | seroval | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-115456 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 12.8 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +5 more | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-112922 | NOISE | 16 | 0 | 25 | 40 | 3.3 | 3.4 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-74915 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | imagination technologies | graphics ddk | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-41022 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 0.3 | none | eaton | easysoft | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82986 | NOISE | 16 | 0 | 25 | 40 | 4.6 | 6.0 | none | nextcloud | tables | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118394 | NOISE | 16 | 0 | 25 | 40 | 9.6 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117677 | NOISE | 16 | 0 | 25 | 40 | 11.2 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117649 | NOISE | 16 | 0 | 25 | 40 | 12.7 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117646 | NOISE | 16 | 0 | 25 | 40 | 11.1 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117635 | NOISE | 16 | 0 | 25 | 40 | 9.6 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116474 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116296 | NOISE | 16 | 0 | 25 | 40 | 9.6 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116289 | NOISE | 16 | 0 | 25 | 40 | 9.6 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120207 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | thelia | thelia page module | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120194 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 41.1 | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 7 · red hat enterprise linux 8 +3 more | 2026-10-31 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118599 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 7.8 | none | gnome | epiphany | 2026-10-31 | no exploitation evidence in any monitored source | ||||
| CVE-2026-109197 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 45.5 | none | wpdirectorykit | wp directory kit | 2026-10-31 | no exploitation evidence in any monitored source | ||||
| CVE-2026-103997 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | davidanderson | redux framework | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2025-9462 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | tobias_conrad | wp2leads | wordpress und klicktipp einfach verbinden – woocommerce und klicktipp einfach verbinden | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-63400 | NOISE | 16 | 0 | 25 | 40 | 2.3 | none | roostorg | coop | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-63399 | NOISE | 16 | 0 | 25 | 40 | 6.9 | none | roostorg | coop | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116502 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 4.4 | none | turboderp-org | exllamav2 | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-63184 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | christianhelle | refitter | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-62347 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | element-hq | element-call | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-62277 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | hargata | lubelog | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-62991 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | shopperlabs | shopper | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119341 | NOISE | 16 | 0 | 25 | 40 | 0.0 | none | tesseract-ocr | tesseract | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119340 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | tesseract-ocr | tesseract | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119338 | NOISE | 16 | 0 | 25 | 40 | 6.9 | none | tesseract-ocr | tesseract | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-62337 | NOISE | 16 | 0 | 25 | 40 | 6.9 | none | axiom-crypto | snark-verifier | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-62335 | NOISE | 16 | 0 | 25 | 40 | 6.9 | none | openvm-org | openvm | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119329 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | immich-app | immich | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119328 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | immich-app | immich | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116250 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116240 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-73322 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache pinot | 2026-10-30 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-119703 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | xinnan-tech | xiaozhi-esp32-server | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119700 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | wpgraphql | wpgraphql | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119699 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | wpgraphql | wpgraphql smart cache | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-108301 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 2.9 | none | tanium | comply | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105947 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | innotim software, telecommunications, and consulting co. ltd. | logsign siem | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118614 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 10.2 | none | ultralytics | ultralytics | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65587 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | imagination technologies | graphics ddk | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-61626 | NOISE | 16 | 1 | 20 | 40 | 7.3 | none | libass | libass | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-46499 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | collaboraonline | online | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119651 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | hulaspark | hula-server | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119648 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | tencentblueking | bk-cmdb | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119647 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | dromara | ruoyi-vue-plus | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117349 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-30 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-117346 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-30 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-119601 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | sshock | afflib | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119416 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | cakephp | cakephp | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119415 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | cakephp | cakephp | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119407 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | element-hq | element-web · element-desktop | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119377 | NOISE | 16 | 0 | 25 | 40 | 2.5 | none | sqlite | sqlite | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119376 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | sqlite | sqlite | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119372 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | sqlite | sqlite | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119147 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | proftpd project | proftpd | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-91920 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | red hat | red hat build of apache camel for spring boot 4 · red hat enterprise linux 8 · red hat enterprise linux 9 +5 more | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119146 | NOISE | 16 | 0 | 25 | 40 | 5.6 | none | proftpd project | proftpd | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-42692 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 15.5 | none | none | themeum | wp crowdfunding | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-108494 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 8.7 | none | none | bob | chained quiz | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-117859 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 9.0 | none | none | red hat | red hat build of keycloak · red hat single sign-on 7 | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-18451 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 4.3 | none | smci | mbd-x12spi | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107157 | NOISE | 16 | 0 | 25 | 40 | 2.0 | 3.9 | none | none | qt | qt | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-7190 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 26.9 | none | none | ict innovations | ict innovations’ php-cgi/php-fpm configuration | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-116396 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | tms | amelia | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117566 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | icret | easyimages2.0 | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118384 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 25.1 | none | gnu | mtools | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117534 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 0.8 | none | redaxo | core | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-77056 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | boneio | black_debian_images | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110733 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | apache software foundation | apache sis | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119548 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | none | getlago | lago | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117626 | NOISE | 16 | 0 | 25 | 40 | 6.4 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117625 | NOISE | 16 | 0 | 25 | 40 | 6.4 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105615 | NOISE | 16 | 0 | 25 | 40 | 3.5 | 3.6 | none | dalibo | postgresql anonymizer | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117513 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 18.2 | none | oretnom23 | php-travel-agency-system | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118395 | NOISE | 16 | 0 | 25 | 40 | 11.0 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119132 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 11.4 | none | bytecodealliance | wasmtime | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87897 | NOISE | 16 | 0 | 25 | 40 | 4.6 | 10.3 | none | nextcloud | whiteboard | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116696 | NOISE | 16 | 0 | 25 | 40 | 3.3 | 1.3 | none | eugeny | russh | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-109209 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 10.8 | none | none | plugins360 | all-in-one video gallery – video player & galleries for youtube, vimeo & self-hosted videos | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-118248 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 20.5 | none | none | highcharts, @highcharts | highcharts · dashboards | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-111068 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 11.6 | none | none | justinnealey | designsetgo | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-116899 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 7.7 | none | redaxo | core | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116885 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 7.9 | none | semanticmediawiki | semanticmediawiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-16020 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 2.8 | none | fazile bacak | defterasist financial advisor platform | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119369 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | liquid web / stellarwp | the events calendar | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116881 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 4.6 | none | semanticmediawiki | semanticmediawiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-50542 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 16.5 | none | none | xibosignage | xibo-cms | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-50543 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 12.8 | none | xibosignage | xibo-cms | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-66911 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 45.5 | none | synacor | zimbra collaboration | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116627 | NOISE | 16 | 0 | 25 | 40 | 5.0 | none | devolutions | powershell universal | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118586 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 24.0 | none | dfm | feedfinder2 | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93847 | NOISE | 16 | 0 | 25 | 40 | 3.5 | none | mattermost | mattermost | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119125 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 16.7 | none | none | parse-community | parse-server | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-116735 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 2.2 | none | libyal | libpff | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116579 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 36.8 | none | none | crossbario | autobahn-python | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-117553 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 42.5 | none | umbraco | umbraco-cms | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-41021 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 7.7 | none | eaton | easye4 | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117557 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 2.5 | none | libsdl-org | sdl_image | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116588 | NOISE | 16 | 0 | 25 | 40 | 8.7 | 40.5 | none | datadog | dd-trace-py | 2026-10-26 | no exploitation evidence in any monitored source | Upgrade dd-trace-py to 3.19.9 or later, or 4.15.6 or later. | |||
| CVE-2026-116741 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 35.1 | none | xiph | speex | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116840 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 2.3 | none | none | ggml-org | llama.cpp | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-116829 | NOISE | 16 | 0 | 25 | 40 | 6.6 | 2.3 | none | ggml-org | llama.cpp | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-70382 | NOISE | 16 | 0 | 25 | 40 | 4.1 | 16.8 | none | wolfvision | cynap pro, cynap core pro, cynap receiver, cynap pure, cynap pure mini, cynap pure pro · cynap pure (next gen), cynap bridge · cynap videobar +1 more | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117507 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 27.8 | none | a2aproject | a2a-java | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117506 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 23.8 | none | a2aproject | a2a-java | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116725 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 3.0 | none | mmitch | gbsplay | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116723 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 5.1 | none | fltk | fltk | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65628 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 3.0 | none | potatosalad | jose | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65632 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 0.5 | none | potatosalad | jose | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117468 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 40.5 | none | esaqa gmbh | psono | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117469 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 27.1 | none | esaqa gmbh | psono | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117470 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 35.1 | none | esaqa gmbh | psono | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76937 | REVIEW | 16 | 0 | 25 | 40 | 9.4 | 39.4 | none | hitachi | jp1/automatic job management system 3 – manager | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.4 with a fix available is never below REVIEW | Update JP1/Automatic Job Management System 3 – Manager to 13-50-31, 12-60-53 or 11-50-39 (or later) per Hitachi advisory hitachi-sec-2026-142. | |||
| CVE-2026-76936 | REVIEW | 16 | 0 | 25 | 40 | 9.4 | 39.4 | none | hitachi | jp1/automatic job management system 3 – manager | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.4 with a fix available is never below REVIEW | Update JP1/Automatic Job Management System 3 – Manager to 13-50-31 or later (or the fixed releases 12-60-53 / 11-50-39 for those branches), per Hitachi SEC-2026-142. | |||
| CVE-2026-106087 | NOISE | 16 | 0 | 25 | 40 | 8.7 | 16.1 | none | hitachi energy | tro600 series firmware | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-92546 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 22.6 | none | keepnet labs cybersecurity inc. | agentic ai / agentic ally | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-100164 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 23.0 | none | rolantis information technologies tourism industry and trade co. ltd. | agentis | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116514 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 28.3 | none | itsourcecode | airline reservation system | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117504 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 46.1 | none | a2aproject | a2a-go | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116478 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 37.5 | none | a2aproject | a2a-go | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116476 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 10.2 | none | a2aproject | a2a-dotnet | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116608 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 4.2 | none | damo academy | videollama2 | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116603 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 21.9 | none | sourcecodester | online food ordering system | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116821 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 20.3 | none | yeswiki | yeswiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116819 | NOISE | 16 | 0 | 25 | 40 | 8.5 | 23.1 | none | openpanel-dev | openpanel | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to OpenPanel 3.0.0 or later; versions before 3.0.0 are affected. | |||
| CVE-2026-116814 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 20.1 | none | openpanel-dev | openpanel | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116806 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 14.8 | none | openpanel-dev | openpanel | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116800 | NOISE | 16 | 0 | 25 | 40 | 6.2 | 43.2 | none | wwbn | avideo | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116823 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 7.4 | none | yeswiki | yeswiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114217 | NOISE | 16 | 0 | 25 | 40 | 8.6 | 0.3 | none | affected product not stated | 2026-10-31 | no exploitation evidence in any monitored source | No fix is available; Red Hat states no mitigation meets its criteria for ease of use, deployment applicability or stability. | ||||
| CVE-2026-120075 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 13.7 | none | none | melapress | wp activity log | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-118037 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 19.9 | none | progress software | telerik document processing libraries | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118038 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 16.7 | none | progress software | telerik document processing libraries | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108307 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 2.5 | none | tanium | endpoint configuration toolset solution · index-cx | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108308 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 28.9 | none | tanium | patch | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108316 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 16.7 | none | tanium | tanium server | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108326 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 7.1 | none | tanium | endpoint configuration toolset solution · cx-stream | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113481 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 2.8 | none | none | unknown | media library assistant | 2026-11-01 | no exploitation evidence in any monitored source | |||
| CVE-2026-108328 | NOISE | 16 | 0 | 25 | 40 | 4.2 | 14.0 | none | tanium | threat response | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87085 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 10.5 | none | tanium | provision | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-87086 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 31.5 | none | tanium | provision | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-88812 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 8.3 | none | x.org | xorg-x11-server · xwayland | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116647 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 15.5 | none | tanium | comply | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108329 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 42.5 | none | tanium | threat response | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade Threat Response to 4.9.476 or later, 4.12.349 or later, or 4.17.327 or later; see Tanium advisory TAN-2026-064. | |||
| CVE-2026-119729 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117621 | NOISE | 16 | 0 | 25 | 40 | 7.5 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117617 | NOISE | 16 | 0 | 25 | 40 | 8.7 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117612 | NOISE | 16 | 0 | 25 | 40 | 8.7 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119065 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 15.3 | none | none | arosoft | shipping zones by drawing for woocommerce | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-116688 | NOISE | 16 | 0 | 25 | 40 | 8.1 | 42.7 | none | ckeditor | ckeditor5 | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade CKEditor 5 to 47.7.4 or later in the 47.x line, or to 48.5.1 or later in the 48.x line. | |||
| CVE-2026-109234 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 32.4 | none | none | tigroumeow | meow lightbox | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-103962 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 11.9 | none | none | wedevs | user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submission | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-111592 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 9.0 | none | none | publishpress | co-authors, multiple authors and guest authors in an author box with publishpress authors | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-116535 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 14.5 | none | none | rainbowgeek | seopress – ai seo plugin & on-site seo | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-117627 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 16.0 | none | red hat | red hat build of keycloak · red hat single sign-on 7 | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118386 | NOISE | 16 | 0 | 25 | 40 | 9.6 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119627 | NOISE | 16 | 0 | 25 | 40 | 18.0 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-66570 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | nickboss | wordpress file upload | 2026-11-01 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116691 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 10.8 | none | mlflow | mlflow | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115957 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 6.3 | none | none | wp discussion board | wp discussion board | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2013-20008 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 16.7 | none | linksys | wag200g | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116687 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 16.8 | none | ckeditor | ckeditor5 | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-103094 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 19.2 | none | none | servicenow | servicenow ai platform | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118375 | NOISE | 16 | 0 | 25 | 40 | 8.1 | 30.7 | none | ggml-org | llama.cpp | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade llama.cpp to b11865 or later; the fix is in PR #30399 (commit 9a0fde9). | |||
| CVE-2013-20007 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 80.8 | none | linksys | wag200g | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-54462 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 31.6 | none | knative | pkg | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-102636 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 6.5 | none | autodesk | fusion | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93517 | NOISE | 16 | 0 | 25 | 40 | 8.5 | 9.0 | none | x.orgg, x.org | xorg-x11-server · xwayland | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to X.org X server 21.1.25 or later, or XWayland 24.1.14 or later; a patch commit is referenced. | |||
| CVE-2026-108014 | NOISE | 16 | 0 | 25 | 40 | 9.1 | 2.5 | none | hclsoftware | domino server | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108015 | NOISE | 16 | 0 | 25 | 40 | 9.1 | 2.5 | none | hclsoftware | notes client | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-102638 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 6.5 | none | autodesk | fusion | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-6064 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 2.1 | none | gen digital | norton antivirus · avast antivirus · avg internet security | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93520 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 10.1 | none | x.org | xorg-x11-server · xwayland | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-63286 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 0.1 | none | axis communications ab | axis camera station pro · axis camera station 5 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-103995 | NOISE | 16 | 0 | 25 | 40 | 2.0 | 29.8 | none | python software foundation | cpython | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115402 | NOISE | 16 | 0 | 25 | 40 | 5.7 | 1.8 | none | openvpn | ovpn-dco-win | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117608 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 3.0 | none | assimp | assimp | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117607 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 52.6 | none | thexerteproject | xerteonlinetoolkits | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-80069 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | stylemix | masterstudy lms wordpress plugin | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-39742 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 8.7 | none | none | liquid web / stellarwp | gutenberg blocks by kadence blocks | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-54862 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 6.3 | none | none | codection | import and export users and customers | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-42707 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 9.6 | none | none | hivepress | hivepress claim listings | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-113697 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 37.5 | none | none | bmc | bmc helix operations management | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-67080 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 27.1 | none | hcl software | bigfix aex | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118036 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 31.5 | none | progress software | telerik document processing libraries | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118094 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 6.3 | none | none | igor funa | ad inserter | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118087 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 6.3 | none | none | gemini labs | site reviews | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-104895 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 32.0 | none | fasterxml | jackson-dataformat-smile | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-58496 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 11.3 | none | thorvg | thorvg | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116682 | NOISE | 16 | 0 | 25 | 40 | 8.6 | 45.2 | none | gtsteffaniak | filebrowser | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to 1.5.2-stable or 2.0.1-beta or later. | |||
| CVE-2026-118170 | NOISE | 16 | 0 | 25 | 40 | 3.5 | none | strapi | strapi open source and enterprise headless cms | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113688 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 23.6 | none | none | bmc | bmc it service management suite | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118171 | NOISE | 16 | 0 | 25 | 40 | 3.5 | none | strapi | strapi open source and enterprise headless cms | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116660 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 14.0 | none | tanium | enforce | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118752 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 3.4 | none | danoli3, freeimage | freeimage | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115606 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 3.8 | none | none | crowd favorite | dxp toolkit | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-117603 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | spesmilo | electrum | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117565 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 33.6 | none | artalkjs | artalk | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118753 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 3.4 | none | danoli3, freeimage | freeimage | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-55561 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 19.9 | none | invoiceplane | invoiceplane | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-100175 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 26.5 | none | none | wayneallen-1 | postie | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-117538 | NOISE | 16 | 0 | 25 | 40 | 4.1 | 7.4 | none | redaxo | core | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117535 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | redaxo | core | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-104729 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 4.7 | none | none | themefusion | avada (fusion) builder | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-104740 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 15.5 | none | none | ifso | if-so dynamic content – elementor & all page builders personalization | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-104743 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 57.9 | none | none | tainacan | tainacan | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-107745 | NOISE | 16 | 0 | 25 | 40 | 4.2 | 25.2 | none | none | tigroumeow | ai engine – mcp server & ai chatbot for wordpress, with claude, chatgpt & gemini | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-56056 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 6.3 | none | none | mamunur rashid | the post grid | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-115967 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 29.1 | none | none | hamid alinia | login with phone number | 2026-10-29 | no exploitation evidence in any monitored source | Update the Login with phone number plugin to version 1.8.79 or later. | ||
| CVE-2026-118585 | NOISE | 16 | 0 | 25 | 40 | 3.5 | 9.7 | none | configuroweb | inventariobasico | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118590 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 36.2 | none | nipy | nibabel | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116817 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 19.1 | none | openpanel-dev | openpanel | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116802 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 12.2 | none | cure53 | dompurify | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-52709 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 6.3 | none | none | bplugins | video gallery block | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-103485 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 27.6 | none | none | hupe13 | extensions for leaflet map | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118577 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 13.7 | none | maotoumao | musicfreedesktop | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118578 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 12.7 | none | maotoumao | musicfreedesktop | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-103875 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 23.2 | none | none | dglingren | media library assistant | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-93522 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 10.1 | none | x.org | xorg-x11-server · xwayland | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111551 | NOISE | 16 | 0 | 25 | 40 | 12.9 | none | apache software foundation | apache kafka | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-93536 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 5.9 | none | x.org | xorg-x11-server · xwayland | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111115 | NOISE | 16 | 0 | 25 | 40 | 14.6 | none | apache software foundation | apache kafka | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111496 | NOISE | 16 | 0 | 25 | 40 | 10.3 | none | apache software foundation | apache kafka | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-93523 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 10.1 | none | x.org | xorg-x11-server · xwayland | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-50539 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 30.7 | none | none | xibosignage | xibo-cms | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-118172 | NOISE | 16 | 0 | 25 | 40 | 7.9 | none | strapi | strapi open source and enterprise headless cms | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118658 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 8.2 | none | labstack | echo | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118266 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 5.5 | none | labstack | echo | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118263 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 32.6 | none | labstack | echo | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108311 | NOISE | 16 | 0 | 25 | 40 | 2.7 | 15.3 | none | tanium | tanium server | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118654 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 28.3 | none | labstack | echo | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118653 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 35.8 | none | labstack | echo | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108685 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 17.6 | none | none | unknown | wp post author | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-110983 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 1.1 | none | none | unknown | wp photo album plus | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-115259 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 9.0 | none | none | unknown | photo engine (media organizer & lightroom) | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-77057 | NOISE | 16 | 0 | 25 | 40 | 2.3 | none | boneio | boneio | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-77055 | NOISE | 16 | 0 | 0 | 65 | 9.3 | none | boneio | black_debian_images | 2026-10-26 | no exploitation evidence in any monitored source | Upgrade to boneio 1.6.0 or later, which removes the sudoers rule and docker group membership and applies signed migrations to devices already in the field. | ||||
| CVE-2026-77053 | NOISE | 16 | 3 | 13 | 45 | 8.7 | none | boneio | boneio | 2026-10-26 | no exploitation evidence in any monitored source | Upgrade to boneIO Black firmware 1.6.0, which requires an administrator account and restricts every API route to an authenticated role; devices on versions before 1.2.0 must be re-flashed with the 1.6.0 system image. | ||||
| CVE-2026-36698 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-26 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-116284 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | n/a | kameleo | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115930 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | mongodb, inc. | mongosh | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110748 | NOISE | 16 | 0 | 25 | 40 | none | apache software foundation | apache sis | 2026-10-26 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-116223 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 26.8 | none | icret | easyimage | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116122 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 38.3 | none | n/a | nocodb | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116119 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 3.5 | none | n/a | nocodb | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116113 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 9.9 | none | n/a | gouguoa | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116110 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 35.0 | none | giantappman | livewallpaper | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115455 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 23.1 | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +5 more | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115300 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 0.7 | none | none | unknown | contact form by supsystic | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-86794 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 20.0 | none | none | unknown | community events | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade the Community Events WordPress plugin to version 1.6.0 or later. | ||
| CVE-2026-118613 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 15.3 | none | ultralytics | ultralytics | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93571 | NOISE | 16 | 0 | 25 | 40 | 2.3 | 8.1 | none | krajowa izba rozliczeniowa | szafir | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111731 | NOISE | 16 | 0 | 25 | 40 | 8.7 | 34.5 | none | rt-labs | p-net | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to P-Net 1.0.3 or later. | |||
| CVE-2026-111733 | NOISE | 16 | 0 | 25 | 40 | 8.7 | 33.9 | none | rt-labs | p-net | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to P-Net 1.0.3 or later. | |||
| CVE-2026-111736 | NOISE | 16 | 0 | 25 | 40 | 8.7 | 33.9 | none | rt-labs | p-net | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to P-Net 1.0.3 or later. | |||
| CVE-2026-111735 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 5.7 | none | rt-labs | p-net | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112200 | NOISE | 16 | 0 | 25 | 40 | 8.7 | 35.7 | none | rt-labs | p-net | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to P-Net 1.0.3 or later. | |||
| CVE-2026-116658 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 26.9 | none | tanium | enforce | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115794 | NOISE | 16 | 0 | 25 | 40 | 2.3 | 7.1 | none | rt-labs | p-net | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115793 | NOISE | 16 | 0 | 25 | 40 | 8.7 | 33.9 | none | rt-labs | p-net | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to P-Net 1.0.3 or later. | |||
| CVE-2026-118673 | NOISE | 16 | 0 | 25 | 40 | 4.1 | 1.5 | none | keepassxreboot | keepassxc | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112256 | REVIEW | 16 | 0 | 25 | 40 | 9.2 | 15.8 | none | opentext | advanced authentication server | 2026-10-29 | floor: pre-auth, no-user-interaction CVSS 9.2 with a fix available is never below REVIEW | Upgrade to 6.4.3.9, 6.5.0.11 or 6.6.2.0 or later, per the OpenText security improvement release notes. | |||
| CVE-2026-65584 | NOISE | 16 | 0 | 25 | 40 | 7.0 | none | imagination technologies | graphics ddk | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119208 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 23.2 | none | py-pdf | pypdf | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119206 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 23.2 | none | py-pdf | pypdf | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-20600 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20599 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20598 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20597 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20596 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20595 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20594 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20593 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20592 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20591 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20590 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20585 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20584 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20583 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20582 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20581 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20580 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20578 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20577 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20576 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20575 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20574 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20573 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20572 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20571 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20570 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20569 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20568 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20567 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20565 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20564 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20563 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20562 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20561 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20560 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20559 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20558 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20557 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20556 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20555 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20554 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-120233 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | ag-ui-protocol | ag-ui | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117680 | NOISE | 16 | 0 | 25 | 40 | 2.1 | none | lud | jsv | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120226 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | hangzhou xiongmai technology | p2papi.dll | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107033 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107035 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-104597 | NOISE | 16 | 0 | 25 | 40 | 14.3 | none | n/a | n/a | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-106036 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 5.9 | none | krajowa izba rozliczeniowa | szafir | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107038 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116408 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | wp chill | gallery photoblocks | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116400 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | bplugins | button block | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115966 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | bplugins | typing text – give your texts many typing effects | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115919 | NOISE | 16 | 0 | 25 | 40 | 6.2 | none | none | onnx | onnx | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111404 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | villatheme | photo reviews for woocommerce | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93850 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | mattermost | mattermost | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107040 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115196 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | affected product not stated | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-88941 | NOISE | 16 | 0 | 25 | 40 | 5.2 | 3.6 | none | none | kaspersky | network agent · administration server | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-115192 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | affected product not stated | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115191 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | affected product not stated | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110881 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 6.3 | none | none | brainstorm force | suredash | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-115605 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 14.3 | none | none | brainstorm force | suredash | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-116098 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 16.9 | none | none | steelraven7 | ravenfield | 2026-10-26 | no exploitation evidence in any monitored source | Apply the EA39 Security Patch for Ravenfield (build 25407073 affected). | ||
| CVE-2026-116402 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 22.7 | none | none | brainstorm force | sureforms | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-116406 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 18.8 | none | none | webba plugins | webba booking | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-115613 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 13.0 | none | none | bplugins | image gallery block – create and display photo gallery/photo album. | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116849 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 7.5 | none | none | bplugins | streamcast | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-115602 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | liquid web / stellarwp | gutenberg blocks by kadence blocks | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114709 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | igor funa | ad inserter | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112865 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | wproyal | royal elementor addons | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116857 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 10.4 | none | none | crocoblock | jetsmartfilters | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-112250 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 7.4 | none | none | bizerba se & co. kg | brain2 | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-103377 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 44.7 | none | none | regional parliament of castile-la mancha | video library of the regional parliament of castile-la mancha | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-118095 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 7.5 | none | none | david lingren | media library assistant | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-116733 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | dvidelabs | flatcc | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116123 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 43.3 | none | none | n/a | nocodb | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-25467 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 18.5 | none | none | themegrill | user registration | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-39736 | NOISE | 16 | 0 | 25 | 40 | 8.5 | 23.3 | none | none | crocoblock | jetengine | 2026-10-29 | no exploitation evidence in any monitored source | Update the WordPress JetEngine plugin to version 3.9.0.2 or later. | ||
| CVE-2026-59176 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 11.4 | none | jordanburke | functype | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-48202 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 21.2 | none | none | brave | brave | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-117623 | NOISE | 16 | 0 | 25 | 40 | 7.5 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118611 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 22.4 | none | alpine | ilx-f511 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115408 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 0.2 | none | eclipse foundation | eclipse keypont | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117539 | NOISE | 16 | 0 | 25 | 40 | 3.5 | none | darylldoyle | svg-sanitizer | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118764 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 21.7 | none | isaacs | minimatch | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade minimatch to version 11.0.1 or later, which fixes the excessive expansion in firstPhasePreProcess(). | |||
| CVE-2026-93010 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 8.9 | none | red hat | red hat ceph storage 9 · red hat enterprise linux 10 · red hat enterprise linux 6 +7 more | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-120199 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | learnhouse | learnhouse | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-80067 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 48.0 | none | none | stylemix | masterstudy lms wordpress plugin | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118092 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 17.9 | none | none | stylemixthemes | masterstudy lms | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-110530 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 15.3 | none | none | radgeek | feedwordpress | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-119134 | NOISE | 16 | 0 | 25 | 40 | 6.2 | 4.4 | none | none | bytecodealliance | wasmtime | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119138 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 17.0 | none | none | bytecodealliance | wasmtime | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119142 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 17.0 | none | none | bytecodealliance | wasmtime | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-61673 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 26.8 | none | labredescefetrj | wegia | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116596 | NOISE | 16 | 0 | 25 | 40 | none | pyrus | pyrus sync | 2026-10-26 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-61719 | NOISE | 16 | 0 | 25 | 40 | 8.9 | 14.7 | none | labredescefetrj | wegia | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to WeGIA 3.8.7 or later, which fixes the stored XSS in saude/historico_prontuarios.php. | |||
| CVE-2026-117548 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 26.8 | none | red hat | red hat directory server 11 · red hat directory server 12 · red hat directory server 13 +5 more | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118652 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 15.0 | none | labstack | echo | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118676 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 9.8 | none | n8n-io | n8n | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118675 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 6.4 | none | n8n-io | n8n | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118648 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 17.6 | none | n8n-io | n8n | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2025-11455 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | tigroumeow | perfect images: regenerate thumbnails, image sizes, webp & avif | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118646 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 16.2 | none | n8n-io | n8n | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118169 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 8.6 | none | none | wpmudev | hustle – email marketing, lead generation, optins, popups | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-63410 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | sgbett | secp256k1-native | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119339 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | tesseract-ocr | tesseract | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57188 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 44.3 | none | none | asterisk | certified-asterisk | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-118603 | NOISE | 16 | 0 | 25 | 40 | 8.0 | 14.8 | none | alpine | ilx-f511 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-62301 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | franklioxygen | mytube | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115950 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | wp smart widgets | better post & filter widgets for elementor | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-22114 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | delta electronics | delta ufc500 | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93519 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 10.1 | none | x.org, x.orgg | xorg-x11-server · xwayland | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-74912 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | imagination technologies | graphics ddk | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105454 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | best practical solutions | request tracker | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-51831 | NOISE | 16 | 0 | 25 | 40 | 4.6 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116384 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | bdtask | garage 24 garage management software | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118437 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 4.8 | none | none | unknown | buddyforms | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-118043 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 5.2 | none | none | unknown | bulk media register | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-119645 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | easysoft | zentaopms | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-104063 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | scribus | scribus | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119661 | NOISE | 16 | 0 | 25 | 40 | 4.2 | none | none | star7th | showdoc | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119653 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | admpub | nging | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119565 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | plausible | plausible analytics | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-94175 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | saad iqbal | all in one login | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-62019 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | liquid web / stellarwp | bookit | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-62023 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | unlimited elements | unlimited elements for elementor (free widgets, addons, templates) | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-62047 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | liquid web / stellarwp | event tickets | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-9239 | NOISE | 16 | 0 | 25 | 40 | 6.4 | none | none | tigroumeow | meow gallery | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-61996 | NOISE | 16 | 0 | 25 | 40 | 8.5 | 32.1 | none | none | favethemes | mls on the fly | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-54865 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 13.1 | none | none | podamibe nepal | podamibe custom user gravatar | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-42694 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 6.8 | none | none | themeum | kirki | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-27394 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 7.0 | none | none | jyothis joy | eventer | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-27062 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 0.7 | none | none | wpfunnels team | wpfunnels | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119059 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 10.4 | none | none | keywordrush | content egg – affiliate product importer & price comparison | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-118634 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 10.0 | none | none | liedekef | events made easy | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-118085 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 7.6 | none | none | global payments | globalpayments woocommerce | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118084 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 25.7 | none | none | nicdark | hotel booking | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-116848 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 2.6 | none | none | posimyth innovations | the plus addons for elementor page builder lite | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-115869 | NOISE | 16 | 0 | 25 | 40 | 6.4 | none | none | themifyme | themify builder | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115820 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | ahmadmj | majestic support – the leading-edge help desk & customer support plugin | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115610 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 3.2 | none | none | publishpress | publishpress authors | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-114711 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | multivendorx | multivendorx | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114706 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 2.6 | none | none | wp chill | strong testimonials | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119429 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | phpmyadmin | phpmyadmin | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119549 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | jellyfin | jellyfin | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119414 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | bitwarden | server | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119417 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | cakephp | cakephp | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-13747 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | tigroumeow | meow gallery | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-90862 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 12.8 | none | none | progress software | ws_ftp server | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-67079 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 5.5 | none | hcl software | bigfix aex | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116261 | NOISE | 16 | 0 | 25 | 40 | 3.5 | none | n/a | libimobiledevice | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116255 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | pgyer | codefever | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-67074 | NOISE | 16 | 0 | 25 | 40 | 9.1 | 39.7 | none | hcl software | bigfix aex | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2024-58399 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 1.8 | none | ggml-org | llama.cpp | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116775 | NOISE | 16 | 0 | 25 | 40 | 2.3 | 22.0 | none | eugeny | russh | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116742 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 2.1 | none | none | samtools | htslib | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-113644 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 7.9 | none | eclipse foundation | eclipse iofog | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116743 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 2.3 | none | libyal | libmsiecf | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116739 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 16.7 | none | kisli | vmime | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116737 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 2.2 | none | libyal | libphdi | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116730 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 3.0 | none | none | tildearrow | furnace | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116740 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 25.8 | none | none | netsurf-browser | libcss | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116736 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 2.2 | none | none | libyal | libpff | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116732 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 2.7 | none | none | davea42 | libdwarf | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-110747 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 32.9 | none | fasterxml | jackson-dataformat-protobuf | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118132 | NOISE | 16 | 0 | 25 | 40 | 12.7 | none | nextchat | nextchat | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-82984 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 19.8 | none | nextcloud | server | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-61846 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | rgrove | crass | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115954 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | dylan kuhn | geo mashup | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115609 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 3.8 | none | none | stiofan | getpaid | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-111109 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 20.5 | none | none | pfefferle | webmention | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-116546 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 10.6 | none | none | wpjobportal | wp job portal – ai-powered recruitment system for company or job board website | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-115596 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 10.0 | none | none | implecode | ecommerce product catalog | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-118035 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 21.8 | none | progress software | telerik document processing libraries | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-103325 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 1.4 | none | none | unknown | tiendacrypto para woocommerce | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-67073 | NOISE | 16 | 0 | 25 | 40 | 8.6 | 13.0 | none | hcl software | bigfix aex | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-67077 | NOISE | 16 | 0 | 25 | 40 | 4.2 | 1.8 | none | hcl software | bigfix aex | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-84294 | NOISE | 16 | 0 | 25 | 40 | 7.7 | 28.9 | none | progress software | ws_ftp server | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116230 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 18.9 | none | none | ndemiccreations, ndemic creations | plague_inc_evolved · plague inc evolved | 2026-10-26 | no exploitation evidence in any monitored source | Upgrade Plague Inc Evolved to version 1.24.0.4 or later, which is unaffected. | ||
| CVE-2026-107029 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120252 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | cgohlke | imagecodecs | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120251 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | cgohlke | imagecodecs | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-42691 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 8.6 | none | none | eventprime | eventprime | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2025-13050 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 17.4 | none | none | centreon | centreon | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-106971 | NOISE | 16 | 0 | 25 | 40 | 4.6 | none | n/a | n/a | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118194 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 27.9 | none | none | cyberlord92 | page and post restriction | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-118435 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 10.9 | none | samsung open source | escargot | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118602 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 1.6 | none | alpine | ilx-f511 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116216 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | maccmspro, magicblack | maccms10 | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115281 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 22.5 | none | none | unknown | recipe card blocks lite | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-115224 | NOISE | 16 | 0 | 25 | 40 | 4.1 | 15.2 | none | none | unknown | customer engagement system | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-116086 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 23.9 | none | affected product not stated | 2026-10-31 | no exploitation evidence in any monitored source | No fix is available; Red Hat states no workaround meets its criteria for ease of use, deployment breadth or stability. | ||||
| CVE-2026-103915 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 17.2 | none | melograno | booking for appointments and events calendar – amelia | 2026-10-31 | no exploitation evidence in any monitored source | ||||
| CVE-2026-55369 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 18.1 | none | walinejs | waline | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-16491 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 21.5 | none | grafana | grafana enterprise · grafana oss | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118040 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 0.4 | none | progress software | telerik document processing libraries | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119571 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | parse-community | parse-server | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118768 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 0.0 | none | randombit | botan | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107027 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-93518 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 10.1 | none | x.org | xorg-x11-server · xwayland | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108304 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 1.9 | none | tanium | endpoint configuration toolset solution · end-user-cx | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118687 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 8.2 | none | none | coder | coder | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-118678 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 22.0 | none | none | n8n-io | n8n | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-118645 | NOISE | 16 | 0 | 25 | 40 | 8.7 | 13.9 | none | none | n8n-io | n8n | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to n8n 1.123.85 or later, 2.43.5 or later, or 2.44.1 or later. | ||
| CVE-2026-118261 | NOISE | 16 | 0 | 25 | 40 | 8.2 | 31.1 | none | none | labstack | echo | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade Echo to 4.16.1 or later, which fixes the unbounded gzip-decoded request size in the Decompress middleware. | ||
| CVE-2026-118249 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 30.1 | none | none | highcharts | highcharts | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-116124 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 36.9 | none | none | gnome | libgsf | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116109 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 67.0 | none | none | continuedev | continue | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-61988 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 14.6 | none | none | morehawes | auction nudge – your ebay on your site | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-25448 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 13.3 | none | none | wedevs | wp erp | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118097 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 6.3 | none | none | bplugins | flash & html5 video | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118756 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 3.7 | none | gopasspw | gopass | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118693 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 3.4 | none | giuspen | cherrytree | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119054 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 13.4 | none | themeisle | multiple pages generator by themeisle | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119051 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 24.9 | none | hughsk | flat | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118692 | NOISE | 16 | 0 | 25 | 40 | 7.0 | 47.8 | none | giuspen | cherrytree | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-75520 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 20.4 | none | domoticz | domoticz | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118691 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 23.7 | none | gudong2003 | xianyu-auto-reply-fix | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118689 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 43.5 | none | ovenmedialabs | ovenmediaengine | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118989 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 18.9 | none | none | webtoffee | product import export for woocommerce | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-107016 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107018 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107021 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2019-25781 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 36.5 | none | python-markdown | markdown | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116795 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 40.2 | none | le0pard | re2js | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-49142 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 29.2 | none | openemr | openemr | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to OpenEMR 8.5.0 or later, which contains the fix for this SQL injection. | |||
| CVE-2026-118426 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 19.0 | none | octopus deploy | octopus server | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118669 | NOISE | 16 | 0 | 25 | 40 | 8.4 | 24.1 | none | oauthlib | oauthlib | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade oauthlib to version 4.0.0 or later. | |||
| CVE-2026-112356 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 16.4 | none | none | gfi usa, llc | gfi kerioconnect | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-118754 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 15.0 | none | dolibarr | dolibarr erp/crm | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118662 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 22.1 | none | vitejs | vite | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119144 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 23.3 | none | frappe | frappe | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade to Frappe Framework 15.111.0 or later, or 16.21.0 or later for the 16.x line. | |||
| CVE-2026-119143 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 11.4 | none | bytecodealliance | wasmtime | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119140 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 10.9 | none | bytecodealliance | wasmtime | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119139 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 10.9 | none | bytecodealliance | wasmtime | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119131 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 23.2 | none | bytecodealliance | wasmtime | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119128 | NOISE | 16 | 0 | 25 | 40 | 7.4 | 21.0 | none | zitadel | zitadel | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115965 | NOISE | 16 | 0 | 25 | 40 | 8.5 | 21.5 | none | none | buddypress | buddypress | 2026-10-29 | no exploitation evidence in any monitored source | Update the BuddyPress plugin to version 14.5.3 or later. | ||
| CVE-2026-116409 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 8.7 | none | none | wp swings | upsell order bump offer for woocommerce | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-93293 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 8.3 | none | none | saadiqbal | password protected – protect your site content with a password | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-96666 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 22.3 | none | none | vberkel | schema app structured data | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-96669 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 22.9 | none | none | wpscripts | food store – online food delivery & pickup | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-116763 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 27.6 | none | none | litespeedtech | litespeed cache | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-48195 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 6.3 | none | none | bplugins | pdf poster | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-115962 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 17.7 | none | none | mycred | mycred | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-109215 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 26.8 | none | none | litespeedtech | litespeed cache | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-107743 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 34.3 | none | none | mapster | mapster wp maps | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-111318 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 19.5 | none | none | devitemsllc | ht mega addons for elementor – elementor widgets & template builder | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118192 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 38.4 | none | none | beardev | joomsport – for sports: team & league, football, hockey & more | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-91152 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 28.2 | none | none | wpeverest | everest forms – contact form, payment form, quiz, survey & custom form builder with ai | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-115611 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 8.7 | none | none | pluginus.net | tableon | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-39735 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 19.9 | none | none | crocoblock | jetengine | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-96741 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 14.7 | none | none | mlfactory | dsgvo all in one for wp | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-96767 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 36.2 | none | none | webaways | nex-forms – ultimate forms plugin for wordpress | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119050 | NOISE | 16 | 0 | 25 | 40 | 8.1 | 37.2 | none | agno-agi | agno | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115593 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 8.7 | none | none | unlimited elements | unlimited elements for elementor (free widgets, addons, templates) | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-116844 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 0.4 | none | none | fclairamb, syncplify, inc. | ftpserverlib · syncplify server! | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-13451 | NOISE | 16 | 0 | 25 | 40 | 7.7 | 11.5 | none | red hat | red hat openshift ai (rhoai) | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118688 | NOISE | 16 | 0 | 25 | 40 | 7.9 | 15.4 | none | bytecodealliance | wasmtime | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118686 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 28.3 | none | espocrm | espocrm | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118679 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 19.7 | none | n8n-io | n8n | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118647 | NOISE | 16 | 0 | 25 | 40 | 8.2 | 17.2 | none | n8n-io | n8n | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to n8n 1.123.85 or later, 2.43.5 or later, or 2.44.1 or later. | |||
| CVE-2026-116673 | NOISE | 16 | 0 | 25 | 40 | 3.3 | 2.4 | none | none | sebhildebrandt | systeminformation | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-112353 | NOISE | 16 | 0 | 25 | 40 | 8.2 | 15.5 | none | none | gfi usa, llc | gfi kerioconnect | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to Kerio Connect 10.0.8 Patch 2 or later; versions below 10.0.8p2 are affected. | ||
| CVE-2026-109972 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 19.9 | none | none | clavaque | s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptions | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-109236 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 28.0 | none | none | zorem | customer email verification for woocommerce | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-107625 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 9.0 | none | none | ultimatemember | ultimate member – user profile, registration, login, member directory, content restriction & membership plugin | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-103996 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 15.5 | none | none | ifso | if-so dynamic content – elementor & all page builders personalization | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-92098 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 11.9 | none | none | webheadllc | webheadcoder multi-step forms for contact form 7 | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-118164 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 10.6 | none | none | ifso | if-so dynamic content – elementor & all page builders personalization | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-116610 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 9.3 | none | none | hornero | clean login | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-109980 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 12.3 | none | none | barrykooij | related posts for wordpress | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-78661 | NOISE | 16 | 0 | 25 | 40 | 8.1 | none | golang.org/x/net | golang.org/x/net/html | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-97045 | NOISE | 16 | 0 | 25 | 40 | 10.1 | none | golang.org/x/net | golang.org/x/net/html | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118377 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 7.6 | none | mewebstudio | pos | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105420 | NOISE | 16 | 0 | 25 | 40 | 9.4 | 44.1 | none | wing soft technology | wing ftp server | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to Wing FTP Server 8.2.6 or later. | |||
| CVE-2026-116078 | NOISE | 16 | 0 | 25 | 40 | 8.7 | 42.4 | none | mtrudel | bandit | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade bandit to 1.14.1 or later; from 0.7.0, HTTP/2 can also be disabled with http_2_options: [enabled: false] as a workaround. | |||
| CVE-2026-50541 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 30.7 | none | xibosignage | xibo-cms | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-52729 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 21.8 | none | xibosignage | xibo-cms | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116683 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 32.0 | none | ctfer-io | terraform-provider-ctfd | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116695 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 29.0 | none | rgrove | crass | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101272 | NOISE | 16 | 0 | 25 | 40 | 2.3 | 28.2 | none | pretix | pretix | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101273 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 30.5 | none | pretix | pretix | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118173 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 22.7 | none | misp | misp-guard | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82332 | NOISE | 16 | 0 | 25 | 40 | 5.7 | 1.6 | none | watchguard | fireware os | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112709 | REVIEW | 16 | 0 | 25 | 40 | 9.2 | 36.3 | none | watchguard | fireware os | 2026-10-27 | Pre-auth heap overflow in Fireware OS’s authentication service, but exploitation requires the attacker to control or intercept traffic to the configured AD server – a position that implies an already-compromised network path rather than a direct internet attack. | Upgrade Fireware OS to 2026.4, 12.12.4, or 12.5.22 or later per the WatchGuard PSIRT advisory; schedule for downtime. Until patched, ensure AD server traffic is on a trusted, segmented path and monitor authentication service for crashes. | |||
| CVE-2026-112710 | REVIEW | 16 | 0 | 25 | 40 | 9.2 | 36.3 | none | watchguard | fireware os | 2026-10-27 | A heap overflow in Fireware OS’s authentication service is reachable without credentials or user interaction, but it requires an attacker to control or intercept the configured Active Directory server, so it is not broadly internet-exploitable. No exploitation has been observed. | Upgrade Fireware OS to 2026.4, 12.12.4, or 12.5.22 or later per the WatchGuard PSIRT advisory; schedule for downtime. Until then, ensure AD traffic to the firewall is on trusted, segmented paths and monitor authentication service crashes. | |||
| CVE-2026-90442 | NOISE | 16 | 0 | 25 | 40 | 8.6 | 15.5 | none | watchguard | fireware os | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to Fireware OS 2026.4, 12.12.4, or 12.5.22 or later, per the WatchGuard PSIRT advisory. | |||
| CVE-2026-105457 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 36.7 | none | havelsan inc. | liman mys | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-58257 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 40.3 | none | jeromedevome | grr | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57198 | NOISE | 16 | 0 | 25 | 40 | 2.3 | 57.4 | none | asterisk | certified-asterisk | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57197 | NOISE | 16 | 0 | 25 | 40 | 7.7 | 44.9 | none | asterisk | certified-asterisk | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57194 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 38.4 | none | asterisk | certified-asterisk | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57191 | NOISE | 16 | 0 | 25 | 40 | 8.2 | 48.3 | none | asterisk | certified-asterisk | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1 or 23.4.1, or Certified Asterisk 20.7-cert11 or 22.8-cert3. | |||
| CVE-2026-57199 | NOISE | 16 | 0 | 25 | 40 | 2.3 | 41.5 | none | asterisk | certified-asterisk | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-109088 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 19.6 | none | x.org | libxtst | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116659 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 23.1 | none | tanium | enforce | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116649 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 10.1 | none | tanium | enforce | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93515 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 9.1 | none | x.org | xorg-x11-server · xwayland | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118039 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 19.0 | none | progress software | telerik document processing libraries | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-106677 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-26 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-118271 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 23.8 | none | a2ui-project | a2ui | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117514 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 35.5 | none | oretnom23 | php-travel-agency-system | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118274 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 23.8 | none | a2ui-project | a2ui | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82947 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 6.4 | none | rt-labs ab | soem | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118129 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 27.9 | none | jeremyckahn | chitchatter | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82944 | NOISE | 16 | 0 | 13 | 49 | 8.8 | 11.2 | none | rt-labs ab | soem | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118273 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 23.8 | none | a2ui-project | a2ui | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-70388 | NOISE | 16 | 0 | 13 | 50 | 8.3 | 11.5 | none | rt-labs ab | soem | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118276 | NOISE | 16 | 0 | 25 | 40 | 3.5 | 15.0 | none | a2ui-project | a2ui | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116726 | NOISE | 16 | 0 | 25 | 40 | 3.3 | 2.3 | none | none | mmitch | gbsplay | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116729 | NOISE | 16 | 0 | 25 | 40 | 3.3 | 2.8 | none | libyal | libfvde | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-16521 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 59.0 | none | smci | mbd-x12stw-f | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65219 | NOISE | 16 | 0 | 25 | 40 | 7.4 | 39.4 | none | smci | mbd-x12spi | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65213 | NOISE | 16 | 0 | 25 | 40 | 6.6 | 45.5 | none | smci | mbd-x12spi | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65210 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 14.4 | none | smci | mbd-x12spi | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65220 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 17.4 | none | smci | mbd-x12spi | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116805 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 12.5 | none | none | openpanel-dev | openpanel | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-116734 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 32.2 | none | none | dvidelabs | flatcc | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116583 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 18.9 | none | none | lxsmnsyc | seroval | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116479 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 24.4 | none | none | a2aproject | a2a-java | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-117341 | NOISE | 16 | 0 | 25 | 40 | 7.7 | 13.3 | none | octopus deploy | octopus server | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-12887 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 15.4 | none | octopus deploy | octopus server | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-102800 | NOISE | 16 | 0 | 25 | 40 | 8.7 | 33.0 | none | dj-extensions.com | dj-helpfularticles extension for joomla | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57187 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 41.5 | none | asterisk | certified-asterisk | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-102788 | REVIEW | 16 | 0 | 25 | 40 | 9.3 | 32.6 | none | balbooa.com | gridbox extension for joomla | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.3 with a fix available is never below REVIEW | Upgrade Gridbox to version 2.20.4.2 or later; versions 1.0.0 through 2.20.4.1 are affected. | |||
| CVE-2026-102789 | REVIEW | 16 | 0 | 25 | 40 | 9.3 | 24.4 | none | balbooa.com | gridbox extension for joomla | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.3 with a fix available is never below REVIEW | Upgrade Gridbox for Joomla to 2.20.4.2 or later. | |||
| CVE-2026-116836 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 9.2 | none | ubiquiti inc | airmax m | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116837 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 11.7 | none | ubiquiti inc | airmax m · ltu ptmp · ltu ptp +1 more | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to airMAX M 6.3.26 or later, LTU PTMP 2.4.2 or later, and LTU PTP 1.5.7 or later per Ubiquiti Security Advisory Bulletin 071. | |||
| CVE-2026-116870 | NOISE | 16 | 0 | 25 | 40 | 8.7 | 13.3 | none | octopus deploy | octopus server | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade Octopus Server to 2026.1.11781, 2026.2.13438 or 2026.3.15816 or later, per advisory SA2026-15. | |||
| CVE-2026-116838 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 32.0 | none | ubiquiti inc | airmax m | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade airMAX M firmware to 6.3.26 or later, per Ubiquiti Security Advisory Bulletin 071. | |||
| CVE-2026-107147 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 33.4 | none | alexandregz | twofactor_gauthenticator | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107145 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 22.9 | none | alexandregz | twofactor_gauthenticator | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107146 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 28.1 | none | alexandregz | twofactor_gauthenticator | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116804 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 7.4 | none | cure53 | dompurify | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116873 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 8.8 | none | semanticmediawiki | semanticmediawiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116883 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 4.0 | none | semanticmediawiki | semanticmediawiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116882 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 4.0 | none | none | semanticmediawiki | semanticmediawiki | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-116879 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 11.8 | none | semanticmediawiki | semanticmediawiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116877 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 26.0 | none | semanticmediawiki | semanticmediawiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116894 | NOISE | 16 | 0 | 25 | 40 | 4.2 | 5.5 | none | none | redaxo | core | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-116898 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 6.1 | none | none | redaxo | core | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-117537 | NOISE | 16 | 0 | 25 | 40 | 4.1 | 7.4 | none | none | redaxo | core | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-65119 | NOISE | 16 | 0 | 25 | 40 | 8.4 | 5.4 | none | nvidia | tensorrt-llm | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117540 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 29.1 | none | darylldoyle | svg-sanitizer | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107014 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-108332 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 4.1 | none | tanium | endpoint configuration toolset solution · threat-response-cx | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108331 | NOISE | 16 | 0 | 25 | 40 | 3.3 | 3.5 | none | tanium | endpoint configuration toolset solution · threat-response-cx | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108330 | NOISE | 16 | 0 | 25 | 40 | 3.6 | 2.4 | none | tanium | endpoint configuration toolset solution · threat-response-cx | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108309 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 1.3 | none | tanium | endpoint configuration toolset solution · performance-cx | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115612 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 10.0 | none | none | iova.mihai | slicewp | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-107046 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-77871 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 15.3 | none | none | saadiqbal | post snippets – custom wordpress code snippets customizer | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-119189 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 5.8 | none | digitalbazaar | forge | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118782 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 2.2 | none | digitalbazaar | forge | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118772 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 40.5 | none | hapijs, @hapi | joi | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-51912 | NOISE | 16 | 0 | 25 | 40 | 15.6 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-51903 | NOISE | 16 | 0 | 25 | 40 | 17.2 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-51902 | NOISE | 16 | 0 | 25 | 40 | 3.8 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-51851 | NOISE | 16 | 0 | 25 | 40 | 15.6 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118766 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 0.7 | none | randombit | botan | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107057 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107056 | NOISE | 16 | 0 | 25 | 40 | 4.6 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107053 | NOISE | 16 | 0 | 25 | 40 | 4.6 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107048 | NOISE | 16 | 0 | 25 | 40 | 7.5 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107041 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-107036 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-117622 | NOISE | 16 | 0 | 25 | 40 | 7.5 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117350 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-30 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-117028 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-30 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-114707 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | crocoblock | jetelements for elementor | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-62250 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | libredwg | libredwg | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107765 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 9.0 | none | none | marketingfire | discussion board – wordpress forum plugin | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-111254 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 23.5 | none | none | boldgrid | w3 total cache | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-115840 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 15.3 | none | none | e4jvikwp | vikrentcar car rental management system | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-107342 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 3.3 | none | none | unknown | kali forms — contact form & drag-and-drop builder | 2026-11-01 | no exploitation evidence in any monitored source | |||
| CVE-2026-112887 | NOISE | 16 | 0 | 25 | 40 | 8.1 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-82898 | NOISE | 16 | 0 | 25 | 40 | 2.1 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101184 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | huawei | harmonyos · emui | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-103404 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 14.2 | none | juniper networks | session smart conductor | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-68590 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20566 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-54866 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 15.5 | none | none | razorpay | razorpay payment button elementor plugin | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-111108 | NOISE | 16 | 0 | 25 | 40 | 18.5 | none | apache software foundation | apache kafka | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119049 | NOISE | 16 | 0 | 25 | 40 | 7.6 | 32.6 | none | none | idinging | freemail | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-42703 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 19.9 | none | none | kaliforms | kali forms | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-113690 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 28.4 | none | none | bmc | bmc it service management suite | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-107627 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 26.2 | none | none | wpsoul | greenshift – animation and page builder blocks | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-104727 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 16.7 | none | none | berocket | sequential order numbers for woocommerce | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-117554 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | admidio | admidio | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-15586 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 11.7 | none | i̇dvlabs software and consulting services inc. | ontime | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107590 | NOISE | 16 | 0 | 25 | 40 | 1.9 | 1.8 | none | qt | qt | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118030 | NOISE | 16 | 0 | 25 | 40 | 4.2 | 5.5 | none | none | red hat | red hat build of keycloak · red hat single sign-on 7 | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-65211 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 24.6 | none | smci | mbd-x12spi | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117471 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 15.4 | none | esaqa gmbh | psono | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116843 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 37.6 | none | mistralai | mistral-vibe | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to Mistral Vibe 3.0.3 or later, which fixes the filter-driver execution ordering in worktree mode. | |||
| CVE-2026-108310 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 23.4 | none | tanium | tanium server | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108306 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 3.1 | none | tanium | endpoint configuration toolset solution · end-user-cx | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108305 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 3.3 | none | tanium | endpoint configuration toolset solution · end-user-cx | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65625 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 1.5 | none | potatosalad | jose | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-104593 | NOISE | 16 | 0 | 25 | 40 | 12.9 | none | n/a | n/a | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116463 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | faststone | image viewer | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116539 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | netty | netty-tcnative-boringssl-static | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116367 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | deepseek | harness | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-65874 | NOISE | 16 | 0 | 25 | 40 | 20.1 | none | apache software foundation | apache fineract | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105272 | NOISE | 16 | 0 | 25 | 40 | 2.3 | 7.3 | none | growi, inc. | growi | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116487 | NOISE | 16 | 0 | 25 | 40 | 4.6 | none | nxp | mcuxsdk-middleware-usb | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116281 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | n/a | kameleo | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116274 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | n/a | jizhicms | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-64618 | NOISE | 16 | 0 | 25 | 40 | 13.7 | none | apache software foundation | apache fineract | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116372 | NOISE | 16 | 0 | 25 | 40 | 7.7 | 29.8 | none | misp | misp-guard | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116228 | NOISE | 16 | 0 | 25 | 40 | 3.3 | 3.6 | none | 777genius | agent-teams-ai | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116104 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 14.1 | none | sony | neural network libraries | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116101 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 9.8 | none | itsourcecode | online cake ordering system | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119204 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 23.2 | none | py-pdf | pypdf | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119202 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 35.4 | none | hapijs | content | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118871 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | zte | elasticnet rnia r18 ngi | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2025-13647 | NOISE | 16 | 0 | 25 | 40 | 5.8 | none | wso2 | wso2 open banking iam · wso2 identity server as key manager · wso2 identity server keystore rest api commons +1 more | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2024-7075 | NOISE | 16 | 0 | 25 | 40 | 4.6 | none | wso2 | wso2 enterprise integrator · wso2 api manager · wso2 identity server +1 more | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101178 | NOISE | 16 | 0 | 25 | 40 | 6.6 | none | huawei | harmonyos · emui | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-28160 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 13.7 | none | none | e4jvikwp | vikrentcar | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-101185 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | huawei | harmonyos | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101183 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | huawei | harmonyos | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101182 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | huawei | harmonyos | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101181 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | huawei | harmonyos | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101180 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | huawei | harmonyos | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101179 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | huawei | harmonyos | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101177 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | huawei | harmonyos · emui | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101176 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | huawei | harmonyos · emui | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101175 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | huawei | harmonyos | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-20553 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20552 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20551 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20550 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20549 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20548 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20547 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20546 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-20499 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-120335 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | deepset-ai | farm | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120325 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | webpro-nl | knip | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120317 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | http4k | http4k | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120316 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | http4k | http4k | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120309 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | nuxt | nuxt | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120323 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | samanhappy | mcphub | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120275 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | shanghai xi yu ji zhi technology | minimax code | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-82705 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120274 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | beecue | fastbee | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120237 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | ag-ui-protocol | ag-ui | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119089 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 14.7 | none | none | supercleanse | thirstyaffiliates – affiliate links, link branding, link tracking & marketing plugin | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-116563 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 28.8 | none | none | smub | photo gallery, sliders, proofing and themes – nextgen gallery | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-116745 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | qloapps | qloapps | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116850 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 7.5 | none | none | wedevs | happy addons for elementor | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-77061 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | boneio | boneio | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-77060 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | none | boneio | black_debian_images | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-112880 | NOISE | 16 | 0 | 25 | 40 | 2.1 | none | none | benoitc | hackney | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115956 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | bplugins | panorama viewer – 360 degree image + video viewer | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115955 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | bplugins | advanced post block – post grid for wordpress block editor | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115953 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | dylan kuhn | geo mashup | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115594 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | david lingren | media library assistant | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114708 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | crocoblock | jetsmartfilters | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-4316 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 35.8 | none | none | zuinq studio | ismygym | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-115949 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | wp smart widgets | better post & filter widgets for elementor | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82946 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 6.3 | none | none | rt-labs ab | soem | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-82943 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 5.9 | none | none | rt-labs ab | soem | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-112828 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 4.3 | none | none | meow apps | ai engine | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-110376 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 4.3 | none | none | villatheme | depart | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-118538 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 22.6 | none | none | a2ui-project | a2ui | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-116893 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 16.7 | none | redaxo | core | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118776 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 2.7 | none | digitalbazaar | forge | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118774 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 1.1 | none | digitalbazaar | forge | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-111850 | NOISE | 16 | 0 | 25 | 40 | 8.5 | 11.3 | none | none | buddypress | buddypress | 2026-10-28 | no exploitation evidence in any monitored source | Update the BuddyPress plugin to version 14.5.3 or later. | ||
| CVE-2026-120246 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | ffmpeg | ffmpeg | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107343 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 2.8 | none | none | unknown | kali forms — contact form & drag-and-drop builder | 2026-11-01 | no exploitation evidence in any monitored source | |||
| CVE-2026-116752 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 26.0 | none | none | paoltaia | geodirectory – wp business directory plugin and classified listings directory | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-107711 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 27.7 | none | none | wppool | flexstock – product stock sync with google sheets for woocommerce | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-118803 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 30.7 | none | bricks | bricks theme | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93008 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | red hat | red hat ceph storage 9 · red hat enterprise linux 10 · red hat enterprise linux 6 +7 more | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-61542 | NOISE | 16 | 0 | 25 | 40 | 8.6 | 23.5 | none | drhelius | gearboy | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to Gearboy 3.8.7 or later, which contains the patch for the unauthenticated MCP HTTP transport. | |||
| CVE-2026-102637 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 6.5 | none | autodesk | fusion | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118680 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 39.8 | none | siyuan-note | siyuan | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118057 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 15.3 | none | none | paultgoodchild | shield security – smart bot blocking, brute-force login protection & file scanning | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-7003 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | wit | synapps runtime | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119331 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | ladybirdbrowser | ladybird | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57185 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 41.3 | none | none | asterisk | certified-asterisk | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-118610 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 27.0 | none | alpine | ilx-f511 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115951 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | kevin weber | lazy load for videos | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115828 | NOISE | 16 | 0 | 25 | 40 | 5.1 | none | none | delinea | secret server | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119298 | NOISE | 16 | 0 | 25 | 40 | 4.2 | none | none | schollz | croc | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-39375 | NOISE | 16 | 0 | 25 | 40 | 5.1 | none | none | frappe | lms | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-61803 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | frappe | lms | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93516 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 8.9 | none | x.org | xorg-x11-server · xwayland | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-61806 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | frappe | lms | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-50000 | NOISE | 16 | 0 | 25 | 40 | 5.0 | none | none | freedomofpress | securedrop | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107050 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118773 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 28.7 | none | none | isaacs | node-glob | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-109997 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 38.5 | none | none | kstover | ninja forms – contact form builder with calculators, quizzes, signatures & ai form builder | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-119421 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | juspay | hyperswitch | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-39739 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | brainstorm force | ultimate addons for elementor – lite | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-52710 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | ithemelandco | giftit – free gifts for woocommerce | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-54850 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | magepeopleteam | booking and rental manager | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119553 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | moodle project | moodle | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119556 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | moodle project | moodle | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119087 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 12.8 | none | none | keywordrush | content egg – affiliate product importer & price comparison | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-109592 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | wordpressdotorg | openstation – admin dashboard notes, custom dashboard, ai assistant & pwa | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119364 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | proftpd project | proftpd | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119375 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | sqlite | sqlite | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119378 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | sqlite | sqlite | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119371 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | sqlite | sqlite | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119276 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 28.7 | none | none | mariadb-corporation | mariadb-connector-j | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119200 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 27.3 | none | nuxt, @nuxt | nuxt · nitro-server | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118475 | NOISE | 16 | 0 | 25 | 40 | 3.6 | 1.2 | none | none | red hat | red hat enterprise linux 6 · red hat enterprise linux 7 · red hat enterprise linux 8 +1 more | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2025-68395 | NOISE | 16 | 0 | 25 | 40 | 5.1 | none | none | arketeam | protectelmaj · bdf | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119278 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 30.3 | none | none | mariadb-corporation | mariadb-connector-j | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-117570 | NOISE | 16 | 0 | 25 | 40 | 5.2 | none | vorota-ai | nmap-mcp | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119665 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | none | mgdaaslab | wharttest | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119657 | NOISE | 16 | 0 | 25 | 40 | 5.0 | none | none | zyx0814 | filepress | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119602 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | kyz | libmspack | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119574 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | traefik | traefik | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119573 | NOISE | 16 | 0 | 25 | 40 | 4.4 | none | none | traefik | traefik | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119570 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | none | parse-community | parse-server | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119569 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | parse-community | parse-server | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119542 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | red hat | red hat build of apache camel 4 for quarkus 3 · red hat data grid 8 · red hat fuse 7 +2 more | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119370 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | liquid web / stellarwp | the events calendar | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118500 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 12.0 | none | none | coolplugins | cool formkit lite – advanced form builder for elementor | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-118370 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 38.3 | none | libexpat | libexpat | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117610 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 36.7 | none | libexpat | libexpat | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114199 | NOISE | 16 | 0 | 25 | 40 | 11.1 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113429 | NOISE | 16 | 0 | 25 | 40 | 13.6 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120218 | NOISE | 16 | 0 | 25 | 40 | 3.5 | none | n/a | typemill | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120192 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | n/a | presenton | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120243 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | ffmpeg | ffmpeg | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120190 | NOISE | 16 | 0 | 25 | 40 | 3.5 | none | n/a | postybirb plus | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120185 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | ken678 | yzncms | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120210 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | ffmpeg | ffmpeg | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109217 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | wpovernight | pdf invoices & packing slips for woocommerce | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-92294 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | brainstormforce | spectra legacy – gutenberg blocks | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-16760 | NOISE | 16 | 0 | 13 | 50 | 8.8 | none | trailofbits | fickling | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118938 | NOISE | 16 | 0 | 13 | 50 | 8.8 | none | trailofbits | fickling | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-62860 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | zoeille | picsou-finance | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-59993 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | h2o | picotls | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119119 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 29.6 | none | unclecode | crawl4ai | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119334 | NOISE | 16 | 0 | 25 | 40 | 2.2 | none | pi-hole | pi-hole | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116246 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | pgadmin.org | pgadmin 4 | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-61789 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | bytebase | dbhub | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-37468 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-30 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-15466 | NOISE | 16 | 0 | 25 | 40 | 7.3 | none | imagination technologies | graphics ddk | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2025-49602 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-30 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-119720 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | blender foundation | blender | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119659 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | blossom-editor | blossom | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119652 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | hulaspark | hula-server | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112348 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | themeum | kirki | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-100355 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | basecamp | once-campfire | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112374 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | fossbilling | fossbilling | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119591 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | sqlite | sqlite | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119567 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | vsftpd | vsftpd | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119563 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | phpmyadmin | phpmyadmin | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119559 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | litespeedtech | openlitespeed | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119558 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | opencart | opencart | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119554 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | moodle project | moodle | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119547 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | forgejo | forgejo | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119546 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | forgejo | forgejo | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119423 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | opnsense | core | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119126 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 18.4 | none | none | parse-community | parse-server | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-18629 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | imagination technologies | graphics ddk | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-52708 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 15.8 | none | none | wedevs | wp user frontend | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-115963 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 14.9 | none | none | videowhisper.com | broadcast live video | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-112827 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 14.9 | none | none | villatheme | handmade – dropshipping for etsy and woocommerce | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-48196 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 6.3 | none | none | kaliforms | kali forms | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-116671 | NOISE | 16 | 0 | 25 | 40 | 2.1 | 1.3 | none | xpdf | xpdf | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-70379 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | wolfvision | cynap pro, cynap core pro | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116398 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | bplugins | content slider block | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-72755 | NOISE | 16 | 0 | 25 | 40 | 3.8 | none | none | nlnet labs | routinator | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82390 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | zephyrproject | zephyr | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115680 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | keil | mdk-middleware | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116516 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | mattermost | mattermost | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115195 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | affected product not stated | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-81509 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | nosduco | nforwardauth | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-33520 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | esri | arcgis server | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116544 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | none | open5gs | open5gs | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93849 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | mattermost | mattermost | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93848 | NOISE | 16 | 0 | 25 | 40 | 2.7 | none | none | mattermost | mattermost | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-97254 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | wproyal | royal elementor addons | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-102787 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 5.7 | none | phoca.cz | phoca download extension for joomla | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116258 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | n/a | libimobiledevice | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-105323 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 7.7 | none | kulga software and telecommunications limited company | kulga news software | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65120 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 3.7 | none | nvidia | tensorrt-llm | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114597 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 22.5 | none | the epics community | epics base | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108325 | NOISE | 16 | 0 | 25 | 40 | 6.6 | 15.7 | none | tanium | reputation | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118371 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 3.0 | none | openbsd | libressl | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117602 | NOISE | 16 | 0 | 25 | 40 | 8.4 | 1.3 | none | spesmilo | electrum | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to Electrum 4.7.2 or later; versions before 4.7.2 are affected. | |||
| CVE-2026-116887 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 3.3 | none | semanticmediawiki | semanticmediawiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116855 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 3.1 | none | none | wphocus | my auctions allegro | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-116404 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 10.0 | none | none | david anderson | redux framework | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-116121 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 13.6 | none | none | n/a | nocodb | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-105617 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 12.2 | none | dalibo | postgresql anonymizer | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118641 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 22.3 | none | none | n8n-io | n8n | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-115942 | NOISE | 16 | 0 | 25 | 40 | 3.1 | none | apache software foundation | apache qpid proton c | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109216 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 13.6 | none | none | metabox | meta box – a framework for dynamic websites | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118425 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 13.7 | none | red hat | red hat build of keycloak · red hat single sign-on 7 | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65626 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 0.5 | none | potatosalad | jose | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-106676 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-26 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-105613 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 7.9 | none | dalibo | postgresql anonymizer | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119466 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | wpexperts | apiexperts square for woocommerce | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116900 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 3.2 | none | none | redaxo | core | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-116215 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 5.7 | none | none | maccmspro, magicblack | maccms10 | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-115921 | NOISE | 16 | 0 | 25 | 40 | 6.2 | 2.7 | none | none | onnx | onnx | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116107 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 12.5 | none | datafeedr | product sets plugin | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-51863 | NOISE | 16 | 0 | 25 | 40 | 30.5 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-109089 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 17.5 | none | x.org | libxi | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110737 | NOISE | 16 | 0 | 25 | 40 | 2.3 | 9.2 | none | vaadin | vaadin · flow · framework | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117620 | NOISE | 16 | 0 | 25 | 40 | 8.7 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117613 | NOISE | 16 | 0 | 25 | 40 | 7.5 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-112344 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 22.5 | none | syncplify, inc. | syncplify server! | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107090 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-26 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-116609 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 27.0 | none | none | osamaesh | wp visitor statistics (real time traffic) | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-61989 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 7.0 | none | none | merv barrett | easy property listings | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118640 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 8.6 | none | n8n-io | n8n | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113494 | NOISE | 16 | 0 | 25 | 40 | 2.7 | 15.2 | none | none | unknown | geodirectory | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-54855 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | cozmoslabs | profile builder | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101325 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 17.1 | none | contrid | newsletters | 2026-10-31 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117645 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | phoenixframework | phoenix_html | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119291 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | zuke-build | zuke | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117184 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-30 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-117182 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-30 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-111487 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | qt | qt framework | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2015-20130 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | netsweeper | netsweeper | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113486 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 2.9 | none | none | unknown | media library assistant | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-119136 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 10.9 | none | bytecodealliance | wasmtime | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119135 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 10.9 | none | bytecodealliance | wasmtime | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117533 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 2.3 | none | none | redaxo | core | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-115795 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 5.7 | none | rt-labs | p-net | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107024 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117619 | NOISE | 16 | 0 | 25 | 40 | 12.6 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117618 | NOISE | 16 | 0 | 25 | 40 | 9.7 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-117615 | NOISE | 16 | 0 | 25 | 40 | 8.7 | none | jenkins project | jenkins | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-108302 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 6.2 | none | tanium | comply | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117503 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | a2aproject | a2a-go | 2026-10-27 | no exploitation evidence in any monitored source | |||||
| CVE-2026-76780 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 10.6 | none | none | rankingcoach | beyondseo – ai seo to improve rankings, listings & online visibility | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-97295 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | david lingren | media library assistant | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-58205 | NOISE | 16 | 0 | 25 | 40 | 8.1 | 21.3 | none | none | jeromedevome | grr | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to GRR 4.5.0 or later, which fixes the reflected XSS in maj.php; also remove leftover installation files. | ||
| CVE-2026-54162 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 16.5 | none | none | alexandre-daubois | ember | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-118667 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 33.6 | none | none | langchain-ai | langgraph-sdk | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-118655 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 23.1 | none | none | labstack | echo | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-116796 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 27.2 | none | none | highcharts | highcharts | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-82411 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 23.4 | none | none | maykinmedia | open-object | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-61573 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 16.5 | none | none | wwbn | avideo-encoder | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-54455 | NOISE | 16 | 0 | 25 | 40 | 7.6 | 16.1 | none | none | opencats | opencats | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-42690 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 14.9 | none | none | thimpress | learnpress | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-39737 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 6.3 | none | none | crocoblock | jetelements for elementor | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119133 | NOISE | 16 | 0 | 25 | 40 | 2.6 | 11.2 | none | none | bytecodealliance | wasmtime | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119121 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 21.2 | none | none | unclecode | crawl4ai | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119048 | NOISE | 16 | 0 | 25 | 40 | 4.2 | 19.2 | none | none | thinkgem | jeesite | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118664 | NOISE | 16 | 0 | 25 | 40 | 8.2 | 24.8 | none | none | samverschueren | decode-uri-component | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade decode-uri-component to version 0.5.1 or later, which fixes the quadratic fallback decoding. | ||
| CVE-2026-118656 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 9.4 | none | none | labstack | echo | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-119127 | NOISE | 16 | 0 | 25 | 40 | 8.1 | 20.3 | none | zitadel | zitadel | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade ZITADEL to 4.19.5 or later; versions 4.0.0 through 4.19.4 are affected. | |||
| CVE-2026-119120 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 36.2 | none | unclecode | crawl4ai | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-5700 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 22.7 | none | none | sabbatic | sabbatic app | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-5697 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 22.7 | none | none | sabbatic | sabbatic app | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-5702 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 7.2 | none | none | sabbatic | sabbatic app | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-113689 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 28.4 | none | none | bmc | bmc it service management suite | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-113694 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 23.6 | none | none | bmc | bmc it service management suite | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-113691 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 37.5 | none | none | bmc | bmc it service management suite | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-113692 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 40.8 | none | none | bmc | bmc it service management suite | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-113696 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 34.4 | none | none | bmc | bmc it service management suite | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-66089 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 19.1 | none | none | apereo foundation | openequella | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118666 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 26.9 | none | ardatan, @graphql-tools | graphql-tools · executor-legacy-ws | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105042 | NOISE | 16 | 0 | 25 | 40 | 13.7 | none | apache software foundation | apache qpid proton c | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114230 | NOISE | 16 | 0 | 25 | 40 | 18.9 | none | apache software foundation | apache qpid proton c | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-88858 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 27.4 | none | grafana | grafana oss · grafana enterprise | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110183 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 5.3 | none | dalibo | postgresql anonymizer | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105618 | NOISE | 16 | 0 | 25 | 40 | 5.7 | 7.3 | none | dalibo | postgresql anonymizer | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-79656 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 5.2 | none | grafana | grafana oss · grafana enterprise | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105620 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 10.0 | none | dalibo | postgresql anonymizer | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105614 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 7.9 | none | dalibo | postgresql anonymizer | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110182 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 7.1 | none | dalibo | postgresql anonymizer | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105612 | NOISE | 16 | 0 | 25 | 40 | 3.5 | 5.7 | none | dalibo | postgresql anonymizer | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118601 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 19.8 | none | alpine | ilx-f511 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118609 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 22.4 | none | alpine | ilx-f511 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118606 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 27.2 | none | alpine | ilx-f511 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118604 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 22.4 | none | alpine | ilx-f511 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118605 | NOISE | 16 | 0 | 25 | 40 | 8.0 | 14.8 | none | alpine | ilx-f511 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118619 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 45.2 | none | ultralytics | ultralytics | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118617 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 18.3 | none | ultralytics | ultralytics | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118616 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 10.2 | none | ultralytics | ultralytics | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118615 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 35.5 | none | ultralytics | ultralytics | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-97019 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 14.7 | none | none | mohammed_kaludi | amp for wp – accelerated mobile pages | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-85655 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 19.6 | none | none | shortpixel | enable media replace | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-77188 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 9.0 | none | none | xootix | waitlist woocommerce ( back in stock notifier ) | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-76005 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 20.7 | none | none | chuck1982 | wp inventory manager | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-116839 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 0.9 | none | none | ubiquiti inc | airmax m | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-116761 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 12.7 | none | none | jtsternberg | cmb2 | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-116750 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 17.9 | none | none | e4jvikwp | vikrentcar car rental management system | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-116749 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 9.0 | none | none | e4jvikwp | vikrentcar car rental management system | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-111820 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 14.9 | none | none | deconf | analytics insights – google analytics dashboard for wordpress | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-111372 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 19.0 | none | none | quantumcloud | ai chatbot for woocommerce – woowbot | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-111213 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 12.8 | none | none | magepeopleteam | travelly – tour & travel booking manager for woocommerce | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-111111 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 15.3 | none | none | bdthemes | prime slider – hero slider, carousel, woocommerce & post slider elementor addons | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-110662 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 23.5 | none | none | mxchat | mxchat – ai chatbot & content generation for wordpress | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-110071 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 10.0 | none | none | kitae-park | mang board | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-110020 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 32.2 | none | none | widgetpack | rich showcase for google reviews | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-10752 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 16.8 | none | none | hwk-fr | advanced custom fields: extended | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-10511 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 9.0 | none | none | artbees | jupiter x core | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-109995 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 14.7 | none | none | wplakeorg | advanced views – display framework – gutenberg/elementor/shortcode | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-109988 | NOISE | 16 | 0 | 25 | 40 | 4.4 | 10.9 | none | none | acowebs | product addons for woocommerce – product options with custom fields | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-109979 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 22.5 | none | none | barrykooij | related posts for wordpress | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-109978 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 15.5 | none | none | cozythemes | cozy blocks – website builder & business growth toolkit | popups, lead forms & inbox | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-109975 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 10.0 | none | none | cozythemes | cozy blocks – website builder & business growth toolkit | popups, lead forms & inbox | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-109974 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 9.0 | none | none | plugins360 | all-in-one video gallery – video player & galleries for youtube, vimeo & self-hosted videos | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-109590 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 15.5 | none | none | magepeopleteam | travelly – tour & travel booking manager for woocommerce | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-109370 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 12.0 | none | none | bplugins | document embedder – let visitors read files without downloading | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-108366 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 10.6 | none | none | wpdevteam | easy.jobs – ai powered job listing, job board, career page, recruitment & hiring solution | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-84725 | NOISE | 16 | 0 | 25 | 40 | 8.1 | 27.9 | none | red hat | red hat jboss enterprise application platform 7 · red hat jboss enterprise application platform 8 | 2026-10-28 | no exploitation evidence in any monitored source | No patch is stated; restrict TCP port 3528 to trusted networks via firewall rules, or disable the IIOP subsystem if CORBA is not required. | |||
| CVE-2026-115223 | NOISE | 16 | 0 | 25 | 40 | 4.9 | 36.2 | none | none | unknown | smart popup by supsystic | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-113485 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 2.9 | none | none | unknown | media library assistant | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-111961 | NOISE | 16 | 0 | 25 | 40 | 3.8 | 9.1 | none | none | unknown | royal mcp | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-111960 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 10.6 | none | none | unknown | royal mcp | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-111032 | NOISE | 16 | 0 | 25 | 40 | 3.8 | 9.1 | none | none | unknown | welcart e-commerce | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-111031 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 15.2 | none | none | unknown | welcart e-commerce | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-111027 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 22.5 | none | none | unknown | welcart e-commerce | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-111021 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 8.8 | none | none | unknown | افزونه پیامک ووکامرس | persian woocommerce sms | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-110507 | NOISE | 16 | 0 | 25 | 40 | 2.7 | 15.2 | none | none | unknown | page builder by siteorigin | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-57189 | NOISE | 16 | 0 | 25 | 40 | 2.3 | 54.5 | none | none | asterisk | certified-asterisk | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-118372 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 3.7 | none | none | openbsd | libressl | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-117609 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 28.6 | none | none | merbanan | rtl_433 | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-117605 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 17.7 | none | none | nopsolutions | nopcommerce | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-117505 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 23.8 | none | none | a2aproject | a2a-java | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-116774 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 17.7 | none | none | eugeny | russh | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-116694 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 31.8 | none | none | open-telemetry | opentelemetry-python | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-116686 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 27.1 | none | none | modelcontextprotocol | python-sdk | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-116679 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 24.0 | none | none | m1k1o | neko | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2014-125137 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 53.9 | none | c97net | qengine cms · kemana directory · cart engine | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2014-125138 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 36.6 | none | c97net | qengine cms · kemana directory · cart engine | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-104383 | NOISE | 16 | 0 | 25 | 40 | 9.4 | 30.5 | none | eaglecloud | aquila | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-102790 | NOISE | 16 | 0 | 25 | 40 | 8.6 | 20.9 | none | icagenda.com | icagenda extension for joomla | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118373 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 0.4 | none | openbsd | libressl | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118374 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 11.4 | none | openbsd | libressl | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-102813 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 9.6 | none | tp-link systems inc. | re305 v3 | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-102812 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 1.8 | none | tp-link systems inc. | re305 v3 · archer c7 v5 | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-77167 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 30.5 | none | nextcloud | server | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82983 | NOISE | 16 | 0 | 25 | 40 | 3.3 | 1.5 | none | nextcloud | tables | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-77171 | NOISE | 16 | 0 | 25 | 40 | 3.5 | 6.8 | none | nextcloud | collectives | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-77172 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 22.0 | none | nextcloud | server | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-77173 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 11.5 | none | nextcloud | files confidential | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114596 | NOISE | 16 | 0 | 25 | 40 | 8.2 | 17.7 | none | the epics community | epics base | 2026-10-27 | no exploitation evidence in any monitored source | Update EPICS Base to the 7.0.11 release. | |||
| CVE-2026-112197 | NOISE | 16 | 0 | 25 | 40 | 9.4 | 31.9 | none | tactis | novigest desktop app | 2026-10-28 | no exploitation evidence in any monitored source | Update the NoviGest Desktop App to version 8.0.0-300 or later, which adds server-validated JWT session tokens, removes the credential and arbitrary-SQL interfaces, and reduces PostgreSQL account privileges. | |||
| CVE-2026-112198 | NOISE | 16 | 0 | 25 | 40 | 8.3 | 5.3 | none | tactis | novigest desktop app | 2026-10-28 | no exploitation evidence in any monitored source | Update the NoviGest Desktop App to version 8.0.0-300 or later, which disables DTDs and external entities during XML processing. | |||
| CVE-2026-93866 | REVIEW | 16 | 0 | 25 | 40 | 9.2 | 43.5 | none | watchguard | fireware os | 2026-10-27 | Pre-authentication heap overflow in Fireware OS Access Portal, reachable over the internet with no user interaction and CVSS 9.2. No public exploit code, KEV listing or EPSS signal yet (EPSS 0.0045), so exploitation is not confirmed. | Upgrade Fireware OS to 2026.4, 12.12.4 or 12.5.22 (or later) per the WatchGuard PSIRT advisory. Until upgraded, disable the Access Portal feature or restrict it to trusted networks, and monitor for anomalous WebSocket requests. | |||
| CVE-2026-111107 | NOISE | 16 | 0 | 25 | 40 | 8.7 | 29.3 | none | watchguard | fireware os | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade to Fireware OS 2026.4, 12.12.4, or 12.5.22 (per the WatchGuard PSIRT advisory). | |||
| CVE-2026-108303 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 16.9 | none | tanium | certificate manager | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade Certificate Manager to 1.17.417 or later, 1.18.368 or later, or 1.22.119 or later, per Tanium advisory TAN-2026-075. | |||
| CVE-2026-116657 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 27.4 | none | tanium | enforce | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108313 | NOISE | 16 | 0 | 25 | 40 | 6.6 | 22.9 | none | tanium | tanium server | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117516 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 35.5 | none | oretnom23 | php-travel-agency-system | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117526 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 3.5 | none | reduxjs | redux-devtools | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116116 | NOISE | 16 | 0 | 13 | 50 | 8.2 | 0.4 | none | yoosee | gm8135s camera | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118378 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 4.3 | none | tabularisdb | tabularis | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117606 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 20.3 | none | blair2004 | nexopos | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115624 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 12.5 | none | growi, inc. | growi | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-109848 | NOISE | 16 | 0 | 25 | 40 | 2.3 | 12.8 | none | growi, inc. | growi | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116841 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 1.9 | none | diasurgical | devilutionx | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65151 | NOISE | 16 | 0 | 25 | 40 | 8.4 | 7.8 | none | nvidia | nemo agent toolkit | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117499 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 0.6 | none | @fastify/session | @fastify/session | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105946 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 39.5 | none | qt | qt | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107472 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 1.8 | none | qt | qt | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117536 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 2.9 | none | redaxo | core | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade REDAXO core to 5.21.3 or later, which is the first unaffected version. | |||
| CVE-2026-4337 | NOISE | 16 | 0 | 25 | 40 | 8.8 | 25.6 | none | pumukit | pumukit | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116897 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 11.0 | none | redaxo | core | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-86577 | REVIEW | 16 | 0 | 25 | 40 | 9.4 | 39.6 | none | hitachi | jp1/integrated management 3 – manager · jp1/automatic job management system 3 – manager · jp1/automatic job management system 3 – agent minimal edition +1 more | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.4 with a fix available is never below REVIEW | Upgrade JP1/Integrated Management 3 Manager, JP1/Automatic Job Management System 3 Manager and Agent to 13-50-31 or later, and JP1/Base to 12-50-54 or later. | |||
| CVE-2026-86576 | REVIEW | 16 | 0 | 25 | 40 | 9.4 | 39.4 | none | hitachi | jp1/integrated management 3 – manager · jp1/automatic job management system 3 – manager · jp1/automatic job management system 3 – agent minimal edition +1 more | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.4 with a fix available is never below REVIEW | Upgrade JP1/Integrated Management 3 – Manager and JP1/Automatic Job Management System 3 Manager/Agent to 13-50-31 or later, and JP1/Base to 12-50-54 or later. | |||
| CVE-2026-82121 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 10.5 | none | hitachi | hirdb server version 10 · hirdb server version 9(32) · hirdb server with additional function version 9(32) | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82122 | REVIEW | 16 | 0 | 25 | 40 | 9.4 | 39.4 | none | hitachi | hirdb server version 10 · hirdb server version 9(32) · hirdb server with additional function version 9(32) | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.4 with a fix available is never below REVIEW | Upgrade HiRDB Server Version 10 to 10-12-01 or later; Version 9 fixes are listed in Hitachi advisory hitachi-sec-2026-144. | |||
| CVE-2026-76935 | REVIEW | 16 | 0 | 25 | 40 | 9.4 | 26.0 | none | hitachi | jp1/automatic job management system 3 – manager | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.4 with a fix available is never below REVIEW | Upgrade JP1/Automatic Job Management System 3 – Manager to version 13-50-31 or later; see Hitachi security advisory hitachi-sec-2026-141. | |||
| CVE-2026-86575 | REVIEW | 16 | 0 | 25 | 40 | 9.4 | 39.4 | none | hitachi | jp1/integrated management 3 – manager · jp1/automatic job management system 3 – manager · jp1/automatic job management system 3 – agent minimal edition +1 more | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.4 with a fix available is never below REVIEW | Upgrade to JP1/Integrated Management 3 – Manager, JP1/Automatic Job Management System 3 – Manager/Agent, or Agent Minimal Edition 13-50-31 or later; JP1/Base to 12-50-54 or later. | |||
| CVE-2026-65627 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 16.2 | none | potatosalad | jose | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-65630 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 3.1 | none | potatosalad | jose | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-76933 | REVIEW | 16 | 0 | 25 | 40 | 9.4 | 39.4 | none | hitachi | jp1/automatic job management system 3 – manager · jp1/automatic job management system 3 – agent minimal edition | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.4 with a fix available is never below REVIEW | Update to JP1/Automatic Job Management System 3 version 13-50-31 or later (or the 12-60-53 / 11-50-39 maintenance releases); see Hitachi SEC-2026-139. | |||
| CVE-2026-76932 | REVIEW | 16 | 0 | 25 | 40 | 9.4 | 39.4 | none | hitachi | jp1/automatic job management system 3 – manager · jp1/automatic job management system 3 – agent minimal edition | 2026-10-27 | floor: pre-auth, no-user-interaction CVSS 9.4 with a fix available is never below REVIEW | Upgrade to JP1/Automatic Job Management System 3 version 13-50-31 or later; fixed builds are also available at 12-60-53 and 11-50-39 for those release lines. | |||
| CVE-2026-116825 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 13.2 | none | yeswiki | yeswiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107043 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110808 | NOISE | 16 | 0 | 25 | 40 | 4.2 | 7.1 | none | none | unknown | essential addons for elementor | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-118598 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 40.6 | none | gnome | epiphany | 2026-10-31 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110251 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | villatheme | revopic – photo reviews for woocommerce | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107030 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-107025 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-119285 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 2.5 | none | gofiber | fiber | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119279 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 28.7 | none | mariadb-corporation | mariadb-connector-j | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119277 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 28.7 | none | mariadb-corporation | mariadb-connector-j | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119210 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 23.1 | none | mariadb-corporation | mariadb-connector-j | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119198 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 21.5 | none | nuxt | nuxt | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-51832 | NOISE | 16 | 0 | 25 | 40 | 4.6 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119196 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 36.8 | none | pyasn1 | pyasn1 | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119194 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 36.8 | none | pyasn1 | pyasn1 | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-107045 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119555 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | moodle project | moodle | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119551 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | jellyfin | jellyfin | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119550 | NOISE | 16 | 0 | 25 | 40 | 3.5 | none | jellyfin | jellyfin | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116522 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 16.0 | none | none | comesio | relevanssi – a better search | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-116548 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 15.3 | none | none | e4jvikwp | vikrentcar car rental management system | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-118070 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 15.3 | none | none | uscnanbu | welcart e-commerce | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-120019 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 12.7 | none | none | boldgrid | w3 total cache | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-119160 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 14.3 | none | none | shapedplugin | smart post – post grid, post carousel, post slider gutenberg blocks for blog & news | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-104926 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 19.1 | none | none | themehigh | woocommerce extra product options pro | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-120114 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 35.3 | none | none | qriouslad | debug log manager – conveniently monitor and inspect errors | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-15272 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 25.1 | none | none | shamalli | web 2.0 directory plugin for wordpress | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-119480 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | crocoblock | jetformbuilder | 2026-11-01 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119728 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-67187 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 6.6 | none | saturday drive | ninja forms | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-20545 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-120334 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | deepset-ai | farm | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116801 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 16.8 | none | none | parse-community | parse-server | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-112355 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 19.1 | none | membershipworks | membershipworks | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105619 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 4.2 | none | dalibo | postgresql anonymizer | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93524 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 7.2 | none | x.org | xorg-x11-server · xwayland | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-113695 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 28.4 | none | none | bmc | bmc it service management suite | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-116662 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 31.5 | none | tanium | enforce | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-5699 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 22.7 | none | none | sabbatic | sabbatic app | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-5698 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 22.7 | none | none | sabbatic | sabbatic app | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-117466 | NOISE | 16 | 0 | 25 | 40 | 8.6 | 13.7 | none | octopus deploy | octopus server | 2026-10-27 | no exploitation evidence in any monitored source | Upgrade Octopus Server to 2026.2.13469 or later, or to 2026.3.15863 or later for the 2026.3.x line; see advisory SA2026-17. | |||
| CVE-2026-116871 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 30.5 | none | semanticmediawiki | semanticmediawiki | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-85498 | NOISE | 16 | 0 | 25 | 40 | 3.5 | 18.0 | none | none | red hat | red hat hardened images · red hat enterprise linux 10 · red hat enterprise linux 6 +5 more | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-18449 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 27.4 | none | smci | x12spi | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116639 | NOISE | 16 | 0 | 25 | 40 | 3.5 | 9.7 | none | md-mafujul-hasan | online-payroll-management-system | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2025-71439 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 1.9 | none | ggml-org | llama.cpp | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-104598 | NOISE | 16 | 0 | 25 | 40 | 14.3 | none | n/a | n/a | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-93846 | NOISE | 16 | 0 | 25 | 40 | 3.8 | none | mattermost | mattermost | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115700 | NOISE | 16 | 0 | 25 | 40 | 6.9 | none | benoitc | hackney | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-113440 | NOISE | 16 | 0 | 25 | 40 | 6.0 | none | benoitc | hackney | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-110314 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | mtrudel | bandit | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-57192 | NOISE | 16 | 0 | 25 | 40 | 6.0 | 51.2 | none | asterisk | certified-asterisk | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118959 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | red hat | red hat build of keycloak · red hat single sign-on 7 | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-104694 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 22.5 | none | none | unknown | thrive automator | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-116492 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | frappe | crm | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101174 | NOISE | 16 | 0 | 25 | 40 | 5.7 | none | huawei | harmonyos | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101173 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | huawei | harmonyos | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101172 | NOISE | 16 | 0 | 25 | 40 | 6.2 | none | huawei | harmonyos | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101171 | NOISE | 16 | 0 | 25 | 40 | 3.6 | none | huawei | harmonyos | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101170 | NOISE | 16 | 0 | 25 | 40 | 4.0 | none | huawei | harmonyos | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2024-5617 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | wso2 | wso2 api manager · wso2 identity server · wso2 carbon identity management +1 more | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-68591 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-68589 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-68588 | NOISE | 16 | 0 | 25 | 40 | none | mediatek, inc. | mediatek chipset | 2026-11-02 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-120320 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | jxxghp | moviepilot | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120319 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | sanluan | publiccms | 2026-11-02 | no exploitation evidence in any monitored source | |||||
| CVE-2026-87718 | NOISE | 16 | 0 | 25 | 40 | 2.3 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-84172 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-107750 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 17.6 | none | none | wpovernight | pdf invoices & packing slips for woocommerce | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-107653 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 20.5 | none | none | surecart | surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & payments | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-100151 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 14.0 | none | none | kstover | ninja forms – contact form builder with calculators, quizzes, signatures & ai form builder | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-74759 | NOISE | 16 | 0 | 15 | 50 | none | affected product not stated | 2026-11-01 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-120236 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | ag-ui-protocol | ag-ui | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120235 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | ag-ui-protocol | ag-ui | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120234 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | ag-ui-protocol | ag-ui | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120232 | NOISE | 16 | 0 | 13 | 50 | 8.8 | none | horizon datasys | reboot restore standard | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-72752 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | nlnet labs | routinator | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-50096 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | esri | arcgis server | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116403 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | awesomemotive | easy digital downloads | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115597 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | thimpress | learnpress | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114710 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | wp chill | gallery photoblocks | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116541 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | netty | netty-tcnative-boringssl-static | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116540 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | netty | netty-tcnative | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116497 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 7 · red hat enterprise linux 8 +2 more | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116486 | NOISE | 16 | 0 | 25 | 40 | 4.5 | none | none | easymock | objenesis | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116213 | NOISE | 16 | 0 | 25 | 40 | 4.9 | none | none | webasyst | webasyst framework | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115718 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | frappe | builder | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116469 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 30.5 | none | none | misp | misp-guard | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-115961 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | bplugins | b slider | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115960 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | wpexperts | apiexperts square for woocommerce | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116120 | NOISE | 16 | 0 | 25 | 40 | 5.6 | 19.8 | none | none | n/a | nocodb | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-118780 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 6.6 | none | digitalbazaar | forge | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118778 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 10.4 | none | digitalbazaar | forge | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116731 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 3.0 | none | tildearrow | furnace | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117555 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 2.5 | none | greyclab | cimg | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-120200 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | gnmyt | nexterm | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-90960 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | seraphinitesoft | seraphinite accelerator | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-93009 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 10.2 | none | red hat | red hat ceph storage 9 · red hat enterprise linux 10 · red hat enterprise linux 6 +7 more | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118537 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 31.8 | none | n/a | a2ui | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93006 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | red hat | red hat ceph storage 9 · red hat enterprise linux 10 · red hat enterprise linux 6 +7 more | 2026-10-29 | no exploitation evidence in any monitored source | |||||
| CVE-2026-114598 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 22.5 | none | the epics community | epics base | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118262 | NOISE | 16 | 0 | 25 | 40 | 8.2 | 22.9 | none | labstack | echo | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade to Echo 4.16.1 or later (4.x), or 5.4.1 or later (5.x). | |||
| CVE-2026-61618 | NOISE | 16 | 0 | 25 | 40 | 6.9 | none | axiom-crypto | snark-verifier | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119730 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | maxthon technology limited | maxthon browser for android | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-58458 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 15.9 | none | klei entertainment | don’t starve together | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117510 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 41.8 | none | dexmal | dexbotic | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118247 | NOISE | 16 | 0 | 25 | 40 | 6.9 | 30.1 | none | highcharts, @highcharts | highcharts · dashboards · grid-pro | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118250 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 30.1 | none | highcharts | highcharts | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116794 | NOISE | 16 | 0 | 25 | 40 | 8.3 | 4.7 | none | eugeny | russh | 2026-10-28 | no exploitation evidence in any monitored source | Upgrade russh to version 0.65.0 or later, which fixes the missing Agent::confirm call in the agent server’s try_sign path. | |||
| CVE-2026-62298 | NOISE | 16 | 0 | 25 | 40 | 0.0 | none | none | mouse07410 | asn1c | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-62254 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | none | libredwg | libredwg | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-61847 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | none | rgrove | crass | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-48201 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | raul p. | fast velocity minify | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110181 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 19.2 | none | dalibo | postgresql anonymizer | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119842 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +2 more | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118608 | NOISE | 16 | 0 | 25 | 40 | 3.5 | 4.3 | none | alpine | ilx-f511 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119644 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | blossom-editor | blossom | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118607 | NOISE | 16 | 0 | 25 | 40 | 6.8 | 58.8 | none | alpine | ilx-f511 | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-110970 | NOISE | 16 | 0 | 25 | 40 | 2.3 | none | none | zakład ubezpieczeń społecznych | płatnik | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-93521 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 10.1 | none | x.org | xorg-x11-server · xwayland | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-117183 | NOISE | 16 | 0 | 25 | 40 | none | n/a | n/a | 2026-10-30 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-48164 | NOISE | 16 | 0 | 25 | 40 | 4.7 | none | none | collaboraonline | online | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105456 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | best practical solutions | rt for incident response | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105455 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | best practical solutions | rt for incident response | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-118485 | NOISE | 16 | 0 | 25 | 40 | 8.1 | 46.6 | none | axel download accelerator | axel | 2026-10-28 | no exploitation evidence in any monitored source | Apply the patch referenced in axel PR 483; the issue is also fixed in version 2.17.16. | |||
| CVE-2026-102260 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 7.1 | none | none | hashicorp | nomad enterprise | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118767 | NOISE | 16 | 0 | 25 | 40 | 4.8 | 12.3 | none | none | randombit | botan | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119162 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 15.3 | none | none | specialk | user submitted posts – enable users to submit posts from the front end | 2026-10-31 | no exploitation evidence in any monitored source | |||
| CVE-2026-119422 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | juspay | hyperswitch | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119425 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | opnsense | core | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119649 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | orchardcms | orchard | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-62057 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | fahim reza | divi contact form 7 | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-62121 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | unlimited elements | unlimited elements for elementor (free widgets, addons, templates) | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-39786 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | bookingalgorithms | ba book everything | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115604 | NOISE | 16 | 0 | 25 | 40 | 5.0 | none | none | brainstorm force | suredash | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105077 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | spacetime | ad inserter | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116405 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | e4jvikwp | vikrentcar | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116847 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | kitae park | mang board wp | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116851 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | none | implecode | ecommerce product catalog | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-104674 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | arraytics | booktics | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116854 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | aguila technologies | wp customer area | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-27061 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | wpeverest | user registration | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119721 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | none | blender foundation | blender | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119176 | NOISE | 16 | 0 | 25 | 40 | 6.4 | none | none | codepeople | cp multi view events calendar | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119113 | NOISE | 16 | 0 | 25 | 40 | 6.4 | none | none | paoltaia | geodirectory – wp business directory plugin and classified listings directory | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-114691 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 33.7 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +5 more | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-114690 | NOISE | 16 | 0 | 25 | 40 | 6.2 | 1.1 | none | none | red hat | red hat enterprise linux 10 · red hat enterprise linux 6 · red hat enterprise linux 7 +5 more | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-109984 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | foliovision | fv flowplayer video player | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-109891 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 3.1 | none | none | wedevs | happy addons for elementor | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-104744 | NOISE | 16 | 0 | 25 | 40 | 7.2 | none | none | independent analytics | independent analytics pro | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-104592 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 13.0 | none | none | n/a | n/a | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-102918 | NOISE | 16 | 0 | 25 | 40 | 6.4 | none | none | davidanderson | redux framework | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119365 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | bplugins | media player addons for elementor – media player widget for wp | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115922 | NOISE | 16 | 0 | 25 | 40 | 6.2 | 2.7 | none | none | onnx | onnx | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-107067 | NOISE | 16 | 0 | 25 | 40 | 6.2 | 5.0 | none | none | n/a | n/a | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-115277 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 5.0 | none | none | unknown | user frontend | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-117572 | NOISE | 16 | 0 | 25 | 40 | 4.1 | 4.8 | none | none | unknown | wp visitor statistics (real time traffic) | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-118101 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 2.8 | none | none | unknown | buddyforms | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-118072 | NOISE | 16 | 0 | 25 | 40 | 5.4 | 2.8 | none | none | unknown | fraud prevention for woocommerce and edd | 2026-10-30 | no exploitation evidence in any monitored source | |||
| CVE-2026-6877 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 28.1 | none | none | servicenow | servicenow ai platform | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119317 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 12.4 | none | none | tenable, inc. | plugin feed | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-105924 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | qt | qt | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116407 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | webba plugins | webba booking | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119280 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 23.4 | none | none | mariadb-corporation | mariadb-connector-j | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118781 | NOISE | 16 | 0 | 25 | 40 | 2.9 | 1.7 | none | none | digitalbazaar | forge | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119203 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 23.2 | none | none | py-pdf | pypdf | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119207 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 23.2 | none | none | py-pdf | pypdf | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-119557 | NOISE | 16 | 0 | 25 | 40 | 5.9 | none | none | n8n-io | n8n | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-45141 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | chamilo | chamilo-lms | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2025-68391 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | arketeam | protectelmaj · bdf | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116590 | NOISE | 16 | 0 | 25 | 40 | 5.9 | 35.0 | none | none | xerial | snappy-java | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116578 | NOISE | 16 | 0 | 25 | 40 | 2.1 | 39.8 | none | none | tornadoweb | tornado | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-120223 | NOISE | 16 | 0 | 25 | 40 | 3.1 | 24.6 | none | oray | pugongying x5 pro | 2026-11-01 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119625 | NOISE | 16 | 0 | 25 | 40 | 17.0 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119533 | NOISE | 16 | 0 | 25 | 40 | 9.6 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119441 | NOISE | 16 | 0 | 25 | 40 | 9.6 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-118504 | NOISE | 16 | 0 | 25 | 40 | 11.9 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120249 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | thelia | thelia back-office default twig template | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120248 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | thelia | thelia core · thelia back-office default twig template | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120247 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | ffmpeg | ffmpeg | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120245 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | ffmpeg | ffmpeg | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120244 | NOISE | 16 | 0 | 25 | 40 | 5.5 | none | ffmpeg | ffmpeg | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120204 | NOISE | 16 | 0 | 25 | 40 | 5.6 | none | deepseek-ai | deepinfer | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120202 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | highflame-ai | ramparts | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-116964 | NOISE | 16 | 0 | 25 | 40 | 8.4 | 27.1 | none | affected product not stated | 2026-10-31 | no exploitation evidence in any monitored source | No fix is available; the only stated mitigation is manual review of pull/merge requests to catch malicious commits before approval. | ||||
| CVE-2026-109367 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 20.5 | none | smub | all in one seo – ai seo plugin to boost seo rankings & traffic (schema, local seo, sitemap & seo insights) | 2026-10-31 | no exploitation evidence in any monitored source | ||||
| CVE-2026-101326 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | kstover | ninja forms – contact form builder with calculators, quizzes, signatures & ai form builder | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-100155 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | kstover | ninja forms – contact form builder with calculators, quizzes, signatures & ai form builder | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-63401 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | roostorg | coop | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-54610 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | libredwg | libredwg | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119282 | NOISE | 16 | 0 | 25 | 40 | 7.3 | 3.4 | none | nrwl, @nx | nx · maven · gradle | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-61694 | NOISE | 16 | 0 | 25 | 40 | 3.7 | none | lejamon | go-xrpl | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-55493 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | kohler | hotcrp | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119330 | NOISE | 16 | 0 | 25 | 40 | 3.5 | none | immich-app | immich | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-61848 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | rgrove | crass | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120046 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | nezhahq | nezha | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119764 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | its-a-feature | mythic | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119761 | NOISE | 16 | 0 | 25 | 40 | 6.1 | none | axigen | axigen mail server | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-61805 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | frappe | lms | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119711 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | pipeshub-ai | pipeshub-ai | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119707 | NOISE | 16 | 0 | 25 | 40 | 7.1 | none | sonicjs-org | sonicjs | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119704 | NOISE | 16 | 0 | 25 | 40 | 6.8 | none | bastillebsd | bastille | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119600 | NOISE | 16 | 0 | 25 | 40 | 4.8 | none | simsong | tcpflow | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119596 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | hdinnovations | unit3d | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-119576 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | arcadedata | arcadedb | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-120217 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | delgan | loguru | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-61993 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 13.7 | none | none | blockonomics | blockonomics | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-120263 | NOISE | 16 | 0 | 25 | 40 | 9.6 | none | gitea | gitea | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-54864 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 7.6 | none | none | nicashmu | post video players | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-118618 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 12.7 | none | ultralytics | ultralytics | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108763 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 8.1 | none | none | unknown | wallet system for woocommerce | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-117611 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 14.9 | none | none | checkmk gmbh | checkmk | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-115592 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 8.7 | none | none | oceanwp | oceanwp | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-22386 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 12.7 | none | none | ahmad | wp job portal | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-24533 | NOISE | 16 | 0 | 25 | 40 | 6.5 | 6.3 | none | none | cozythemes | cozy blocks | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-112839 | NOISE | 16 | 0 | 25 | 40 | 4.3 | none | none | villatheme | customer coupons for woocommerce | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-102799 | NOISE | 16 | 0 | 25 | 40 | 5.3 | 21.4 | none | icagenda.com | icagenda extension for joomla | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116727 | NOISE | 16 | 0 | 25 | 40 | 3.3 | 2.8 | none | mmitch | gbsplay | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116747 | NOISE | 16 | 0 | 25 | 40 | 8.1 | 49.9 | none | rajnandan1 | kener | 2026-10-26 | no exploitation evidence in any monitored source | Upgrade to Kener 4.1.10 or later, which removes the hardcoded fallback secret; also set a strong KENER_SECRET_KEY. | |||
| CVE-2026-116555 | NOISE | 16 | 0 | 25 | 40 | 2.4 | 11.2 | none | n/a | argilla | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115920 | NOISE | 16 | 0 | 25 | 40 | 6.2 | none | none | onnx | onnx | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115804 | NOISE | 16 | 0 | 25 | 40 | 6.4 | none | none | hashicorp | consul enterprise | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116395 | NOISE | 16 | 0 | 25 | 40 | 6.5 | none | none | bplugins | lightbox block | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-16307 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 8.8 | none | netiket information technologies | edoweb | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-105987 | NOISE | 16 | 0 | 25 | 40 | 5.1 | 15.0 | none | kgs software | tia viewer | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-109090 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 17.5 | none | x.org | libxi | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-108333 | NOISE | 16 | 0 | 25 | 40 | 2.5 | 2.1 | none | tanium | endpoint configuration toolset solution · threat-response-cx | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116656 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 31.5 | none | tanium | enforce | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-57190 | NOISE | 16 | 0 | 25 | 40 | 7.0 | 52.3 | none | none | asterisk | certified-asterisk | 2026-10-27 | no exploitation evidence in any monitored source | |||
| CVE-2026-111727 | NOISE | 16 | 0 | 25 | 40 | 6.4 | 10.6 | none | none | codepeople | appointment booking calendar | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-24269 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 3.7 | none | nvidia | tensorrt-llm | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116394 | NOISE | 16 | 0 | 25 | 40 | 5.3 | none | none | magepeople inc. | wpevently | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-115603 | NOISE | 16 | 0 | 25 | 40 | 8.5 | 11.3 | none | none | advanced ads gmbh | advanced ads – tracking | 2026-10-28 | no exploitation evidence in any monitored source | Update the Advanced Ads – Tracking plugin to version 4.0.0 or later. | ||
| CVE-2026-112357 | NOISE | 16 | 0 | 25 | 40 | 7.8 | 2.5 | none | gfi usa, llc | gfi kerioconnect | 2026-10-28 | no exploitation evidence in any monitored source | ||||
| CVE-2026-11854 | NOISE | 16 | 0 | 25 | 40 | 6.1 | 11.6 | none | none | wso2 | wso2 api manager · wso2 api control plane · wso2 identity server | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-41020 | NOISE | 16 | 0 | 25 | 40 | 7.5 | 13.4 | none | eaton | easye4 | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-61575 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 7.2 | none | none | wwbn | avideo-encoder | 2026-10-28 | no exploitation evidence in any monitored source | |||
| CVE-2026-115303 | NOISE | 16 | 0 | 25 | 40 | 3.7 | 13.0 | none | none | unknown | contact form by supsystic | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-114488 | NOISE | 16 | 0 | 25 | 40 | 7.4 | 27.2 | none | red hat | red hat fuse 7 · red hat jboss enterprise application platform 7 · red hat jboss enterprise application platform 8 +2 more | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-62141 | NOISE | 16 | 0 | 25 | 40 | 5.4 | none | none | wp manageninja llc | fluent crm | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-104623 | NOISE | 16 | 0 | 25 | 40 | 6.3 | none | none | suse | rancher | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-61995 | NOISE | 16 | 0 | 25 | 40 | 7.1 | 13.7 | none | none | emarket-design | youtube showcase | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-116728 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 3.0 | none | none | libyal | libfvde | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116538 | NOISE | 16 | 0 | 25 | 40 | 4.7 | 21.3 | none | none | mganss | htmlsanitizer | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116477 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 24.4 | none | none | a2aproject | a2a-dotnet | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116369 | NOISE | 16 | 0 | 25 | 40 | 6.3 | 72.3 | none | none | sunwood-ai-labs | github-kanban-mcp-server | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116283 | NOISE | 16 | 0 | 25 | 40 | 4.3 | 20.7 | none | none | n/a | kameleo | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-116280 | NOISE | 16 | 0 | 25 | 40 | 5.5 | 5.3 | none | none | n/a | kameleo | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-19199 | NOISE | 16 | 0 | 25 | 40 | 3.3 | none | imagination technologies | graphics ddk | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-111730 | NOISE | 16 | 0 | 25 | 40 | 7.2 | 8.2 | none | rt-labs | p-net | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116127 | NOISE | 15 | 0 | 10 | 50 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-118995 | NOISE | 15 | 0 | 10 | 50 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-118991 | NOISE | 15 | 0 | 10 | 50 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-107019 | NOISE | 15 | 0 | 20 | 40 | none | n/a | n/a | 2026-10-29 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-111734 | NOISE | 15 | 0 | 20 | 40 | 7.1 | 5.7 | none | rt-labs | p-net | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-116273 | NOISE | 15 | 0 | 10 | 50 | 7.3 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-118990 | NOISE | 15 | 0 | 10 | 50 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-10756 | NOISE | 14 | 0 | 25 | 30 | 7.7 | 7.6 | none | hitachi energy | tro600 series firmware | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-119086 | NOISE | 14 | 0 | 25 | 30 | 6.5 | none | none | freertos | freertos-kernel | 2026-10-30 | no exploitation evidence in any monitored source | ||||
| CVE-2026-88781 | NOISE | 14 | 0 | 25 | 30 | 6.8 | 1.3 | none | asus | motherboards firmware | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-120241 | NOISE | 14 | 1 | 25 | 30 | 7.5 | none | ruijie | rg-es205gc · rg-es206gc-p · rg-es208gc +2 more | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-65586 | NOISE | 14 | 0 | 25 | 30 | 3.3 | none | imagination technologies | graphics ddk | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-78188 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-31 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-115943 | NOISE | 13 | 0 | 10 | 40 | 17.0 | none | affected product not stated | 2026-10-29 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-116131 | NOISE | 13 | 0 | 10 | 40 | 23.8 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-119037 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-116130 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-13576 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-116134 | NOISE | 13 | 0 | 10 | 40 | 23.8 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-116264 | NOISE | 13 | 0 | 10 | 40 | 7.3 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-74760 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-11-01 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-116268 | NOISE | 13 | 0 | 10 | 40 | 7.3 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-13575 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-11-01 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-116133 | NOISE | 13 | 0 | 10 | 40 | 23.8 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-116272 | NOISE | 13 | 0 | 10 | 40 | 7.2 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-116270 | NOISE | 13 | 0 | 10 | 40 | 7.3 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-116266 | NOISE | 13 | 0 | 10 | 40 | 7.3 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-118986 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-118987 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-116269 | NOISE | 13 | 0 | 10 | 40 | 7.3 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-116132 | NOISE | 13 | 0 | 10 | 40 | 27.7 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-116271 | NOISE | 13 | 0 | 10 | 40 | 8.8 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-116135 | NOISE | 13 | 0 | 10 | 40 | 27.7 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-117501 | NOISE | 13 | 0 | 10 | 40 | 15.1 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-116265 | NOISE | 13 | 0 | 10 | 40 | 7.3 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-118988 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-119036 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-119038 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-87768 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-118996 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-116285 | NOISE | 13 | 0 | 10 | 40 | 21.4 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-115946 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-11-01 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-113345 | NOISE | 13 | 0 | 0 | 50 | 8.5 | 1.8 | none | none | ministry of land, infrastructure, transport and tourism, japan | electronic delivery item inspection support system | 2026-10-26 | CISA SSVC: total technical impact | |||
| CVE-2026-116531 | NOISE | 13 | 0 | 10 | 40 | 21.4 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-118993 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-115866 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-115865 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-116128 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-78189 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-31 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-118994 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-30 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-116267 | NOISE | 13 | 0 | 10 | 40 | 7.3 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-117500 | NOISE | 13 | 0 | 10 | 40 | 18.4 | none | affected product not stated | 2026-10-28 | no exploitation evidence in any monitored source | ||||||
| CVE-2026-78190 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-31 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-78191 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-31 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-78192 | NOISE | 13 | 0 | 10 | 40 | none | affected product not stated | 2026-10-31 | no exploitation evidence in any monitored source | |||||||
| CVE-2026-118636 | NOISE | 11 | 16 | 13 | 0 | 9.8 | none | apache software foundation | apache mina | 2026-10-31 | no exploitation evidence in any monitored source | |||||
| CVE-2026-82558 | NOISE | 10 | 0 | 25 | 15 | 2.3 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-101259 | NOISE | 10 | 0 | 25 | 15 | 5.3 | 27.7 | none | apache software foundation | apache camel | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-82115 | NOISE | 10 | 0 | 25 | 15 | 6.3 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-10537 | NOISE | 10 | 0 | 25 | 15 | 5.3 | 21.2 | none | bmc | control-m/enterprise manager · control-m/server | 2026-10-27 | no exploitation evidence in any monitored source | ||||
| CVE-2026-71569 | NOISE | 10 | 0 | 25 | 15 | 4.8 | 28.1 | none | none | apache software foundation | apache camel | 2026-10-29 | no exploitation evidence in any monitored source | |||
| CVE-2026-82557 | NOISE | 10 | 0 | 25 | 15 | 6.9 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-82559 | NOISE | 10 | 0 | 25 | 15 | 2.3 | none | apache software foundation | apache wicket | 2026-11-01 | no exploitation evidence in any monitored source | |||||
| CVE-2026-94386 | NOISE | 10 | 0 | 25 | 15 | 4.8 | none | none | apache software foundation | apache camel | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-55612 | NOISE | 10 | 0 | 25 | 15 | 3.7 | none | openwrt | uhttpd | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-55613 | NOISE | 10 | 0 | 25 | 15 | 6.9 | none | openwrt | uhttpd | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-95663 | NOISE | 10 | 0 | 25 | 15 | 4.8 | 15.5 | none | apache software foundation | apache camel | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-62333 | NOISE | 9 | 3 | 0 | 30 | 8.7 | none | openvm-org | openvm | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to 1.7.0 or later in the 1.x line, 2.0.0-rc.3 or later in the 2.0 line, or 2.1.0-preview or later. | ||||
| CVE-2026-55614 | NOISE | 8 | 0 | 25 | 5 | 6.9 | none | openwrt | uhttpd | 2026-10-30 | no exploitation evidence in any monitored source | |||||
| CVE-2026-40573 | NOISE | 8 | 0 | 0 | 30 | 8.6 | none | minecanton209 | novumos | 2026-10-30 | no exploitation evidence in any monitored source | Upgrade to NovumOS 0.25-beta.1 or later, which fixes the Nova interpreter privilege issue. | ||||
| CVE-2026-95628 | NOISE | 8 | 0 | 25 | 5 | 5.4 | 26.7 | none | none | apache software foundation | apache camel | 2026-10-26 | no exploitation evidence in any monitored source | |||
| CVE-2026-62374 | NOISE | 8 | 0 | 25 | 5 | 7.1 | 13.3 | none | openwallet-foundation | @sd-jwt/core · @sd-jwt/decode | 2026-10-29 | no exploitation evidence in any monitored source | ||||
| CVE-2026-95629 | NOISE | 8 | 0 | 25 | 5 | 5.4 | 26.7 | none | apache software foundation | apache camel | 2026-10-26 | no exploitation evidence in any monitored source | ||||
| CVE-2026-83525 | NOISE | 8 | 0 | 25 | 5 | 8.2 | none | apache software foundation | apache kafka | 2026-10-28 | no exploitation evidence in any monitored source | |||||
| CVE-2026-93570 | NOISE | 8 | 0 | 25 | 5 | 8.2 | 20.3 | none | krajowa izba rozliczeniowa | szafir weryfikująca | 2026-10-29 | no exploitation evidence in any monitored source | Upgrade Szafir to version 2.0 build 708 or later; Szafir Weryfikująca is end-of-life and will not be fixed. | |||
| CVE-2026-115721 | NOISE | 8 | 1 | 25 | 5 | 7.5 | none | apache software foundation | apache vysper | 2026-10-26 | no exploitation evidence in any monitored source | |||||
| CVE-2026-115748 | NOISE | 5 | 9 | 0 | 0 | 8.8 | none | apache software foundation | apache vysper | 2026-10-26 | no exploitation evidence in any monitored source |
About this brief
Quatronics began publishing this brief when CISA retired its Weekly Vulnerability Bulletin on
28 September 2026. CISA continues to publish the KEV catalogue and its cybersecurity advisories; this brief is
not affiliated with or endorsed by CISA. Every input is a public, official source: the CVE Program, the NIST
National Vulnerability Database, CISA KEV and SSVC decision points, FIRST EPSS, and the public Metasploit,
Exploit-DB and nuclei repositories. Prioritisation weights those signals against deployment breadth and
remediation cost, and every entry is reviewed by a Quatronics analyst before publication.
