Daily digest
Monday 5 October 2026
A busier-than-usual day with 421 new CVEs (recent average about 353). Of those, 30 critical and 154 high. 125 arrived with exploitation evidence or public exploit code already attached. makeplane was the most-affected vendor with 38.
New this day, ranked by depth score
The 12 that matter most of the 421 published.
CVE-2026-21589Critical· 9.3CISA KEVPoCThis is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerabili…
MAL-2026-17628Critical⚠ ExploitedMalicious code in erc7730-hackathon (PyPI)
Malicious code in erc7730-hackathon (PyPI)
CVE-2026-105740Critical· 9.9PoCLangflow is a tool for building and deploying AI-powered agents and workflows
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The …
CVE-2026-105697Critical· 9.9PoCLangflow is a tool for building and deploying AI-powered agents and workflows
Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10…
CVE-2026-105691Critical· 9.9PoCPenpot is an open-source design and prototyping platform
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.ex…
CVE-2026-105636Critical· 9.9PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect targets. validate_url…
CVE-2026-105285Critical· 10.0PoCA security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455
A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS of the component QoS Rule Handler. The manipulation of the argument addQos/comment/entry_…
CVE-2026-105284Critical· 10.0PoCA weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455
A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorizat…
CVE-2026-88424Critical· 9.8PoCFineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter()
FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via crafted SQL stateme…
CVE-2026-88395Critical· 9.8PoCGouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.
GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.
CVE-2026-88393Critical· 9.8PoCWookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php, which execut…
CVE-2026-88391Critical· 9.8PoCNorthstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / em…
Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / em…
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
- CVE-2026-104056Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin bindingexploit_available, severity, cvss66
- CVE-2026-51880deeptutor 1.4.0 contains a path traversal issue in EditFileTool.executeseverity, cvss, exploit_available66
- CVE-2026-51884The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversalseverity, cvss, exploit_available66
- CVE-2026-51893infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmapseverity, cvss, exploit_available66
- CVE-2026-51897RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app)severity, cvss, exploit_available66
Most-affected vendors
By CVEs published in the period.