Daily digest
Saturday 10 October 2026
420 new CVEs this day, in line with the recent average. Severity skewed high: 83 critical and 137 high, 52% of the total. 95 arrived with exploitation evidence or public exploit code already attached. jeecgboot was the most-affected vendor with 76.
New this day, ranked by depth score
The 12 that matter most of the 420 published.
MAL-2026-17757Critical⚠ ExploitedMalicious code in webreader (PyPI)
Malicious code in webreader (PyPI)
MAL-2026-17756Critical⚠ ExploitedMalicious code in pafer (PyPI)
Malicious code in pafer (PyPI)
MAL-2026-17755Critical⚠ ExploitedMalicious code in agent-vx (PyPI)
Malicious code in agent-vx (PyPI)
MAL-2026-17753Critical⚠ ExploitedMalicious code in media-manager5 (PyPI)
Malicious code in media-manager5 (PyPI)
MAL-2026-17752Critical⚠ ExploitedMalicious code in agentaix (PyPI)
Malicious code in agentaix (PyPI)
CVE-2026-108598Critical· 9.8PoCFloci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK inte…
CVE-2026-108551Critical· 9.8PoCopenapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. A…
CVE-2026-106610Critical· 9.8PoCIncorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.
CVE-2026-103889Critical· 9.8PoCThe 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce…
CVE-2026-108628High· 8.1PoCJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attac…
CVE-2026-62129Critical· 9.9Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
CVE-2026-62024Critical· 9.9Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.
Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
- CVE-2026-88647A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.severity, cvss62
- CVE-2026-76284Improper Neutralizationseverity, cvss54
- CVE-2026-75352OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parserseverity, cvss53
- CVE-2026-75353OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parserseverity, cvss53
- CVE-2026-95116An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c.severity, cvss53
Most-affected vendors
By CVEs published in the period.