Daily digest
Thursday 8 October 2026
A busier-than-usual day with 545 new CVEs (recent average about 441). Of those, 56 critical and 193 high. 62 arrived with exploitation evidence or public exploit code already attached. CISA added 5 CVEs to the Known Exploited Vulnerabilities catalog. ibm was the most-affected vendor with 93.
Added to CISA KEV
Confirmed exploitation in the wild — federal remediation deadlines attach to these.
CVE-2015-3306Critical· 10.0CISA KEVPoCThe mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
CVE-2016-3081High· 8.1CISA KEVPoCApache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVE-2015-5477High· 7.5CISA KEVPoCnamed in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
CVE-2021-3199Critical· 9.8CISA KEVPoCDirectory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
CVE-2023-22894Medium· 4.9CISA KEVPoC⚖ disputedStrapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from …
New this day, ranked by depth score
The 12 that matter most of the 545 published.
MAL-2026-17703Critical⚠ ExploitedMalicious code in kafka-roller (PyPI)
Malicious code in kafka-roller (PyPI)
MAL-2026-17702Critical⚠ ExploitedMalicious code in kafka-helmsman (PyPI)
Malicious code in kafka-helmsman (PyPI)
CVE-2026-85097Critical· 9.8PoCThe Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploa…
CVE-2026-105110Critical· 9.8PoCOS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
CVE-2026-92555Critical· 9.8PoCInsertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co
Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX…
CVE-2026-9209Critical· 9.8PoCmJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against t…
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against t…
CVE-2026-107722Critical· 9.8PoCfast-jwt provides fast JSON Web Token (JWT) implementation
fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDe…
CVE-2026-107704Critical· 9.8PoCThe image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is ena…
The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is ena…
CVE-2026-107703Critical· 9.8PoC@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments
@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters o…
CVE-2026-107700Critical· 9.8PoCdot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get()
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers ca…
CVE-2026-107406Critical· 9.5PoCMemory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specif…
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specif…
CVE-2026-95210Critical· 9.1PoC⚖ disputedImproper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.
Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901Envoy 1.9.0 and before does not normalize HTTP URL pathsseverity, cvss37
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available57
- CVE-2025-71383Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password fieldseverity, cvss, exploit_available66
- CVE-2026-79657NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callablesseverity, cvss, exploit_available66
- CVE-2026-56397SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScriptseverity, cvss, exploit_available65
- CVE-2025-9611Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connectionsseverity, cvss, exploit_available52
- CVE-2026-76839Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filteringseverity, cvss, exploit_available48
Most-affected vendors
By CVEs published in the period.