Daily digest

Saturday 3 October 2026

A quiet day: only 127 new CVEs against a recent average of about 450. Of those, 17 critical and 42 high. 29 arrived with exploitation evidence or public exploit code already attached. Legion of the Bouncy Castle Inc. was the most-affected vendor with 12.

127

New CVEs

Critical

KEV additions

Records changed

New this day, ranked by depth score

The 12 that matter most of the 127 published.

MAL-2026-17629Critical⚠ Exploited

4w ago

Most-changed records

Existing CVEs whose severity, score, KEV or exploitation status moved.

CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
CVE-2014-6407Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.cvss42
CVE-2026-103877Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java c…severity, cvss54
CVE-2026-80980In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out_of_sync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smc_connection …severity, cvss54
CVE-2026-101160The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make th…severity, cvss53
CVE-2026-101161The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent den…severity, cvss53
CVE-2026-103626Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML pageseverity, cvss53

Most-affected vendors

By CVEs published in the period.

Saturday 3 October 2026

New this day, ranked by depth score

Malicious code in zencleaner (PyPI)

Malicious code in caoxiltts (PyPI)

Malicious code in voxcpmruntime (PyPI)

Malicious code in infrabench (PyPI)

Malicious code in voxcpmintel (PyPI)

Malicious code in voxcpmui4 (PyPI)

Malicious code in voxcpmkit (PyPI)

Malicious code in voxcpmeval (PyPI)

Malicious code in voxcpmui3 (PyPI)

Malicious code in voxcpmtts3 (PyPI)

Malicious code in echogen (PyPI)

Malicious code in voxel-tts (PyPI)

Most-changed records

Most-affected vendors