CVE Tracker

This week in vulnerabilities

Generated from the tracker data. KEV additions, new High and Critical CVEs, and the ones ThreatWire has written up.

Window: 2026-10-08 to 2026-10-15. Last updated 15 Oct 2026. Sources: NVD API 2.0, CISA KEV catalog. New CVEs cover only High and Critical records published in the tracker window. Search the full tracker · KEV RSS

Added to CISA KEV (11)

Known to be exploited. Federal agencies have a due date to patch.

CVE-2026-765199.8 criticalKEVKEV 2026-10-14
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco / Secure Email Gateway
CVE-2026-1051349.3 criticalKEVKEV 2026-10-14
Ahsay AhsayCBS Command Injection Vulnerability
Ahsay / AhsayCBS
CVE-2026-1051335.5 mediumKEVKEV 2026-10-14
Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay / AhsayCBS
CVE-2026-03228.6 highKEVKEV 2026-10-14
Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks / PAN-OS
CVE-2026-969518.8 highKEVKEV 2026-10-13
Microsoft Windows Command Injection Vulnerability
Microsoft / Windows
CVE-2026-1049358.6 highKEVKEV 2026-10-13
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti / Connect Secure
CVE-2023-228944.9 mediumKEVKEV 2026-10-08
Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi / Strapi
CVE-2021-31999.8 criticalKEVKEV 2026-10-08
ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE / Docs
CVE-2016-30818.1 highKEVKEV 2026-10-08
Apache Struts Command Injection Vulnerability
Apache / Struts
CVE-2015-54777.5 highKEVKEV 2026-10-08
ISC BIND Data Processing Errors Vulnerability
ISC / BIND
CVE-2015-330610.0 criticalKEVKEV 2026-10-08
ProFTPD Improper Access Control Vulnerability
ProFTPD / ProFTPD

New High and Critical CVEs (349)

Published in the window, not in KEV. Showing the top 40 by score.

CVE-2026-9722910.0 criticalThreatWire coverage2026-10-13
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19…
gitlab / gitlab
CVE-2026-4838310.0 critical2026-10-13
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitra…
Unknown / Unknown
CVE-2026-11053610.0 critical2026-10-14
A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdo…
Unknown / Unknown
CVE-2026-10911010.0 critical2026-10-13
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component…
Unknown / Unknown
CVE-2026-10891810.0 critical2026-10-12
A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/…
Unknown / Unknown
CVE-2026-10889210.0 critical2026-10-12
A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MAC…
Unknown / Unknown
CVE-2026-10880410.0 critical2026-10-12
A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the…
Unknown / Unknown
CVE-2026-821109.9 critical2026-10-12
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary…
ibm / datastage on cloud pak for data
CVE-2026-1091089.9 critical2026-10-13
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen o…
Unknown / Unknown
CVE-2026-1089299.9 critical2026-10-12
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /r…
Unknown / Unknown
CVE-2026-1089149.9 critical2026-10-12
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the f…
Unknown / Unknown
CVE-2026-1088969.9 critical2026-10-12
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file…
Unknown / Unknown
CVE-2026-976689.8 critical2026-10-14
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart…
Unknown / Unknown
CVE-2026-876849.8 critical2026-10-08
A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric vers…
broadcom / fabric operating system
CVE-2026-876599.8 critical2026-10-08
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS v…
broadcom / fabric operating system
CVE-2026-850979.8 criticalThreatWire coverage2026-10-08
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to…
Unknown / Unknown
CVE-2026-842469.8 critical2026-10-08
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due…
ibm / guardium data protection
CVE-2026-842099.8 critical2026-10-08
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands…
ibm / guardium data protection
CVE-2026-841989.8 critical2026-10-08
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due…
ibm / guardium data protection
CVE-2026-840589.8 critical2026-10-08
IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL…
ibm / guardium data protection
CVE-2026-840579.8 critical2026-10-08
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due…
ibm / guardium data protection
CVE-2026-840359.8 critical2026-10-08
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due…
ibm / guardium data protection
CVE-2026-828959.8 critical2026-10-08
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due…
ibm / guardium data protection
CVE-2026-823449.8 critical2026-10-08
IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap…
ibm / guardium data protection
CVE-2026-823359.8 critical2026-10-08
IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB pr…
ibm / guardium data protection
CVE-2026-819329.8 critical2026-10-08
IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated at…
ibm / guardium data protection
CVE-2026-767799.8 critical2026-10-09
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restrict…
dell / policy manager for secure connect gateway
CVE-2026-631469.8 critical2026-10-13
Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-cont…
Unknown / Unknown
CVE-2026-149889.8 critical2026-10-08
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0…
ibm / datapower gateway
CVE-2026-148889.8 critical2026-10-08
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0…
ibm / datapower gateway
CVE-2026-1106439.8 critical2026-10-14
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execut…
Unknown / Unknown
CVE-2026-1106409.8 critical2026-10-14
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute co…
Unknown / Unknown
CVE-2026-1106389.8 critical2026-10-14
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute comma…
Unknown / Unknown
CVE-2026-1106369.8 critical2026-10-14
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pd…
Unknown / Unknown
CVE-2026-1106359.8 critical2026-10-14
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers th…
Unknown / Unknown
CVE-2026-1100029.8 critical2026-10-14
The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up t…
Unknown / Unknown
CVE-2026-1095669.8 critical2026-10-12
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unaut…
Unknown / Unknown
CVE-2026-1094399.8 critical2026-10-14
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication…
Unknown / Unknown
CVE-2026-1087079.8 critical2026-10-11
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows…
Unknown / Unknown
CVE-2026-1081079.8 critical2026-10-09
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRA…
Unknown / Unknown

Covered by ThreatWire (16)

This week's CVEs that have a ThreatWire record. A PoC link is not an exploit; see each record for status.

CVE-2026-9722910.0 criticalThreatWire coverage2026-10-13
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19…
gitlab / gitlab
CVE-2026-972058.1 highThreatWire coverage2026-10-14
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous f…
Unknown / Unknown
CVE-2026-934798.1 highThreatWire coverage2026-10-14
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the r…
Unknown / Unknown
CVE-2026-92392No scoreThreatWire coverage2026-10-14
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRE…
Unknown / Unknown
CVE-2026-858847.8 highThreatWire coverage2026-10-13
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an au…
Unknown / Unknown
CVE-2026-850979.8 criticalThreatWire coverage2026-10-08
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to…
Unknown / Unknown
CVE-2026-718966.5 mediumThreatWire coverage2026-10-08
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users'…
Unknown / Unknown
CVE-2026-718957.1 highThreatWire coverage2026-10-08
An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Ku…
Unknown / Unknown
CVE-2026-711837.1 highThreatWire coverage2026-10-08
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information ab…
Unknown / Unknown
CVE-2026-660878.1 highThreatWire coverage2026-10-08
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task i…
Unknown / Unknown
CVE-2026-660848.1 highThreatWire coverage2026-10-08
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task de…
Unknown / Unknown
CVE-2026-660826.5 mediumThreatWire coverage2026-10-08
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauth…
Unknown / Unknown
CVE-2026-151768.1 highThreatWire coverage2026-10-14
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias…
Unknown / Unknown
CVE-2026-1104479.2 criticalThreatWire coverage2026-10-14
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote cod…
Unknown / Unknown
CVE-2026-1074069.5 criticalThreatWire coverage2026-10-08
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScale…
Unknown / Unknown
CVE-2026-1035728.8 highThreatWire coverage2026-10-13
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Ser…
Unknown / Unknown