CVErdict · exploited and likely-next CVEs

CVE-2026-107056 · Likely next

2026-11-04T01:00:19.858Z

Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message.

CVE-2026-107050 · Likely next

2026-11-04T00:58:08.546Z

An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution.

CVE-2026-107045 · Likely next

2026-11-04T00:55:38.760Z

Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.

CVE-2026-107040 · Likely next

2026-11-04T00:53:08.270Z

Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

CVE-2026-38600 · Likely next

2026-11-03T21:33:06.189Z

A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.

CVE-2026-107021 · Likely next

2026-11-03T15:05:08.487Z

Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.

CVE-2026-107027 · Likely next

2026-11-03T15:01:47.646Z

Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.

CVE-2026-107038 · Likely next

2026-11-03T14:54:09.686Z

Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.

CVE-2026-118527 · Ivanti Connect Secure · Exploited

2026-11-03T14:53:28.232Z

Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.

CVE-2026-107043 · Likely next

2026-11-03T14:36:27.795Z

Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.

CVE-2026-107048 · Likely next

2026-11-03T14:29:59.039Z

An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.

CVE-2026-107053 · Likely next

2026-11-03T14:26:16.360Z

Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox.

CVE-2026-106803 · Likely next

2026-11-03T13:31:38.995Z

A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. When processing a crafted application/reginfo+xml NOTIFY message, process_contact() copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger stack corruption and terminate the P-CSCF process, resulting in denial of service.

CVE-2026-4052 · WSO2 WSO2 API Manager · Likely next

2026-11-03T08:02:33.735Z

Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager) This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.

CVE-2026-13594 · Zohocorp Log360 · Likely next

2026-11-03T07:29:10.038Z

Improper Access Control vulnerability Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.

CVE-2026-107029 · Likely next

2026-11-03T00:25:49.496Z

Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.

CVE-2026-79589 · Likely next

2026-11-03T00:16:00.557Z

The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is caused by the exposure of the UART debugging interface having a lack of authentication, authorization and access control functionality. Once the interface is soldered and connected to the attacker, they gain root privilege to the system.

CVE-2026-119977 · WordPress Foundation WordPress · Exploited

2026-11-03T00:00:00.000Z

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

CVE-2026-51863 · Likely next

2026-11-02T16:25:02.875Z

DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.

CVE-2026-120446 · madong-code madong-admin-saas · Likely next

2026-11-02T14:29:06.068Z

madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.

CVE-2026-116606 · Barracuda Networks Barracuda Email Security Gateway (ESG) · Likely next

2026-11-02T12:59:11.278Z

Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

CVE-2025-11969 · WSO2 WSO2 API Manager · Likely next

2026-11-02T05:53:51.375Z

Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.

CVE-2026-112688 · Apple iOS and iPadOS · Likely next

2026-11-02T05:45:28.000Z

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Parsing a file may lead to an unexpected app termination or arbitrary code execution.

CVE-2026-84295 · Progress Software WS_FTP Server · Likely next

2026-11-01T04:20:14.000Z

Improper Authentication in Progress WS_FTP Server Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

CVE-2026-112487 · Apple macOS · Likely next

2026-10-31T18:04:33.000Z

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.

CVE-2026-112816 · Canonical LXD · Likely next

2026-10-31T16:18:52.000Z

Improper certificate validation in the HTTPS listener in LXD Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

CVE-2026-103039 · Gravity Forms Gravity Forms · Likely next

2026-10-31T15:33:32.000Z

Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution. Where the custom field is mapped to the protected _wp_page_template meta key, WordPress itself supplies the chain:…

CVE-2026-78845 · Likely next

2026-10-31T02:21:08.387Z

Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root description parsing.

CVE-2026-103688 · Checkout Files Upload for WooCommerce · Likely next

2026-10-30T21:26:05.000Z

Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers that execute PHP from the uploads directory.

CVE-2026-106378 · Google Chrome · Likely next

2026-10-30T18:44:07.000Z

Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-107017 · Likely next

2026-10-30T18:07:46.206Z

Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions.

CVE-2026-107028 · Likely next

2026-10-30T18:05:22.139Z

Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data.

CVE-2026-107034 · Likely next

2026-10-30T18:03:00.504Z

Likely next · score 52/100. Critical 9.1 · network (v3.1); CISA SSVC: public PoC · Oct 30; CISA SSVC: total technical impact; CISA SSVC: automatable

CVE-2026-109566 · zofe rapyd-admin · Likely next

2026-10-30T17:13:27.000Z

Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.

CVE-2026-118238 · Tenda W18E · Likely next

2026-10-30T15:08:41.752Z

CVE-2026-118238 The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.

CVE-2026-114625 · Arista Networks VeloCloud Orchestrator · Exploited

2026-10-30T12:35:43.000Z

Security Advisory 0199 VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

CVE-2026-116366 · ClickHouse ClickHouse · Likely next

2026-10-30T11:00:11.115Z

Unauthenticated RCE vulnerability against ClickHouse Server An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

CVE-2025-31704 · Dahua Intelligent Connection Center · Likely next

2026-10-30T10:25:46.561Z

Dahua Intelligent Connection Center command injection A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.

CVE-2026-107249 · Drupal Block AJAX · Likely next

2026-10-30T03:10:24.115Z

Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192 Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

CVE-2026-118539 · Drupal Commerce Core · Likely next

2026-10-30T03:09:13.976Z

Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

CVE-2026-111357 · Ivanti Connect Secure · Exploited

2026-10-30T00:00:00.000Z

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

CVE-2023-22793 · Veeam Management Pack for Microsoft System Center · Likely next

2026-10-29T22:55:37.594Z

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

CVE-2026-107032 · Likely next

2026-10-29T20:05:15.916Z

Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

CVE-2026-107058 · Likely next

2026-10-29T19:53:59.673Z

An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.

CVE-2026-107015 · Likely next

2026-10-29T19:51:28.197Z

Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database.

CVE-2026-118579 · D-Link DIR-505 · Likely next

2026-10-29T15:50:23.842Z

D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-114148 · Microsoft .NET 10.0 installed on Linux · Likely next

2026-10-29T15:21:47.615Z

Likely next · score 50/100. 1 PoC repo (1 vetted) — unverified, may be malware; CISA SSVC: total technical impact; Vendor in KEV (×390): Microsoft; High 7.8 · local (v3.1)

CVE-2026-93680 · IBM Langflow OSS · Likely next

2026-10-29T15:18:37.766Z

Likely next · score 84/100. Metasploit: auxiliary/gather/langflow_auth_bypass_cve_2026_93680 (normal); Critical 9.8 · network (v3.1); CISA SSVC: total technical impact; Vendor in KEV (×8): IBM

CVE-2026-104339 · IBM Langflow OSS · Likely next

2026-10-29T15:16:38.628Z

Langflow OSS is affected by multiple vulnerabilities IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

CVE-2026-107326 · IBM Langflow OSS · Likely next

2026-10-29T15:16:30.710Z

Langflow OSS is affected by multiple vulnerabilities IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

CVE-2026-107327 · IBM Langflow OSS · Likely next

2026-10-29T15:16:23.183Z

Langflow OSS is affected by multiple vulnerabilities IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.

CVE-2026-107328 · IBM Langflow OSS · Likely next

2026-10-29T15:16:15.011Z

CVE-2026-107329 · IBM Langflow OSS · Likely next

2026-10-29T15:16:06.801Z

CVE-2026-110186 · IBM Langflow OSS · Likely next

2026-10-29T15:15:59.506Z

Langflow OSS is affected by multiple vulnerabilities IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

CVE-2026-109722 · Mozilla Firefox · Likely next

2026-10-29T02:33:57.000Z

JIT miscompilation in the JavaScript Engine: JIT component JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-97229 · GitLab GitLab · Exploited

2026-10-29T00:00:00.000Z

Integer Overflow or Wraparound in GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

CVE-2026-76418 · Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software · Exploited

2026-10-29T00:00:00.000Z

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

CVE-2026-114268 · Tenda BE3L Pro · Likely next

2026-10-28T17:59:03.838Z

Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.

CVE-2026-113744 · Tenda AC19 · Likely next

2026-10-28T16:20:49.387Z

Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-113736 · D-Link DHP-W610AV · Likely next

2026-10-28T15:45:56.320Z

D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-59177 · esphome device-builder · Likely next

2026-10-28T13:12:14.620Z

ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue…

CVE-2026-103780 · Dell PowerProtect Data Domain · Likely next

2026-10-28T10:14:39.716Z

CVE-2026-86384 · Dell PowerProtect Data Domain · Likely next

2026-10-28T09:51:07.110Z

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to credential exposure. The credentials may be used to access the system with privileges of the compromised user.

CVE-2026-86397 · Dell PowerProtect Data Domain · Likely next

2026-10-28T09:02:11.392Z

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to privileged account creation. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.

CVE-2026-86400 · Dell PowerProtect Data Domain · Likely next

2026-10-28T08:50:11.332Z

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.

CVE-2026-116692 · mlflow mlflow · Likely next

2026-10-28T04:15:21.000Z

MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module beneath a writable allowed package and submit its module and class through /ajax-api/3.0/mlflow/scorer/invoke. Scorer.model_validate_json() imports the module and constructs the class before trace processing. Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts. In either configuration, the allowed scorer package must be writable by the server process. This issue is fixed in version 3.17.0.

CVE-2026-116690 · mlflow mlflow · Likely next

2026-10-27T19:42:35.798Z

MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when a source has a URL scheme, and mlflow.prompt.is_prompt is interpreted by tag presence rather than a true value. A remote caller can store a server-local path as the model version artifact location and use /api/2.0/mlflow/model-versions/get-artifact to read files accessible to the MLflow server process. Default unauthenticated servers require no privileges, while basic-auth deployments are exposed to authenticated users who can create registered models. This issue is fixed in version 3.17.0.

CVE-2026-97798 · Microsoft Windows 10 Version 21H2 · Likely next

2026-10-27T17:45:26.000Z

Windows Error Reporting Service Elevation of Privilege Vulnerability Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

CVE-2026-105781 · Adobe Adobe Campaign Classic · Likely next

2026-10-27T17:03:34.741Z

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-112353 · GFI USA, LLC GFI KerioConnect · Exploited

2026-10-27T16:10:08.568Z

GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.

CVE-2026-93857 · WatchGuard Fireware OS · Likely next

2026-10-27T15:52:27.970Z

Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.

CVE-2026-93865 · WatchGuard Fireware OS · Likely next

2026-10-27T15:52:27.668Z

Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.

CVE-2026-117532 · redaxo core · Likely next

2026-10-27T15:17:19.000Z

REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.

CVE-2026-15176 · F5 NGINX Plus · Likely next

2026-10-27T13:36:49.000Z

NGINX ngx_http_core_module vulnerability A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical…

CVE-2026-115905 · zip-rs zip2 · Likely next

2026-10-27T07:34:30.000Z

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.

CVE-2026-93328 · Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) · Likely next

2026-10-27T05:07:58.000Z

Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.

CVE-2026-111497 · Google Brotli · Exploited

2026-10-27T00:00:00.000Z

Out-of-Bounds Write in Google Brotli Decoder A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

CVE-2026-116817 · Openpanel-dev openpanel · Likely next

2026-10-26T23:05:44.806Z

OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health.

CVE-2026-116748 · transmission transmission · Likely next

2026-10-26T21:52:45.799Z

Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.

CVE-2026-112552 · Apple macOS · Likely next

2026-10-26T20:44:01.047Z

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with control of a network file server may be able to cause unexpected system termination.

CVE-2026-112690 · Apple iOS and iPadOS · Likely next

2026-10-26T20:37:50.437Z

This issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. A remote attacker may be able to break out of the WebContent sandbox.

CVE-2026-112526 · Apple macOS · Likely next

2026-10-26T20:34:19.670Z

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause unexpected app termination.

CVE-2026-113897 · Apple Safari · Likely next

2026-10-26T20:33:12.644Z

This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break out of Web Content sandbox.

CVE-2026-3322 · Lobster DATA GmbH Lobster_pro · Exploited

2026-10-26T14:41:12.655Z

Privilege escalation via request replaying in Lobster_pro Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.

CVE-2026-107656 · Fortinet FortiSandbox · Likely next

2026-10-26T13:45:03.962Z

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests

CVE-2026-116485 · huangxd- danmu_api · Likely next

2026-10-26T13:08:51.363Z

danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.

CVE-2026-101767 · Oracle Corporation Oracle Application Object Library · Likely next

2026-10-26T02:40:31.000Z

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-109618 · PHP Group PHP · Exploited

2026-10-26T00:00:00.000Z

RCE via OOM corruption PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CVE-2026-109619 · PHP Group PHP · Exploited

2026-10-26T00:00:00.000Z

RCE via stale global state PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

CVE-2026-107092 · Likely next

2026-10-26T00:00:00.000Z

Likely next · score 62/100. 1 PoC repo (1 vetted) — unverified, may be malware; Critical 9.8 · network (v3.1); CISA SSVC: total technical impact; CISA SSVC: automatable

CVE-2026-31158 · Likely next

2026-10-26T00:00:00.000Z

Likely next · score 62/100. 1 PoC repo (1 vetted) — unverified, may be malware; Critical 9.8 · network (v3.1); CISA SSVC: total technical impact; CISA SSVC: automatable

CVE-2026-116205 · YesWiki yeswiki · Likely next

2026-10-25T13:20:35.879Z

YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal hosts and ports and read their responses.

CVE-2026-116167 · siyuan-note siyuan · Likely next

2026-10-25T13:20:10.372Z

SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.

CVE-2026-116070 · dqzboy Docker-Proxy · Likely next

2026-10-25T11:50:58.565Z

Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.

CVE-2026-116067 · ananthakumaran paisa · Likely next

2026-10-25T11:50:56.480Z

Paisa before 0.7.8 Path Traversal via Editor and Sheet API Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.

CVE-2026-116006 · YunaiV ruoyi-vue-pro · Likely next

2026-10-25T03:30:25.691Z

YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-114820 · Oracle Corporation Oracle Java SE · Likely next

2026-10-24T19:33:38.000Z

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability…

CVE-2026-110922 · Google Chrome · Likely next

2026-10-24T09:26:07.000Z

Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-112866 · WPFactory Product Filter by WBW · Likely next

2026-10-24T08:00:11.483Z

WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.

CVE-2026-102785 · yootheme.com YOOtheme Pro extension for Joomla · Exploited

2026-10-24T00:19:23.000Z

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.