Daily digest
Tuesday 13 October 2026
A heavy day: 2,313 new CVEs, well above the recent average of about 504. Severity skewed high: 167 critical and 1,361 high, 66% of the total. 184 arrived with exploitation evidence or public exploit code already attached. CISA added 2 CVEs to the Known Exploited Vulnerabilities catalog. Microsoft was the most-affected vendor with 1,403.
Added to CISA KEV
Confirmed exploitation in the wild — federal remediation deadlines attach to these.
CVE-2026-104935High· 8.6CISA KEV0dayPoCAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
CVE-2026-96951High· 8.8CISA KEV0dayPoCImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
New this day, ranked by depth score
The 12 that matter most of the 2313 published.
CVE-2026-104935High· 8.6CISA KEV0dayPoCAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
CVE-2026-96951High· 8.8CISA KEV0dayPoCImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
MAL-2026-17863Critical⚠ ExploitedMalicious code in crelic-bqwheel-52f66a3f1d (PyPI)
Malicious code in crelic-bqwheel-52f66a3f1d (PyPI)
MAL-2026-17862Critical⚠ ExploitedMalicious code in fontcase (PyPI)
Malicious code in fontcase (PyPI)
MAL-2026-17861Critical⚠ ExploitedMalicious code in sysdiagd (PyPI)
Malicious code in sysdiagd (PyPI)
CVE-2026-97229Critical· 10.0PoCGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary cod…
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary cod…
CVE-2026-55675Critical· 10.0PoCThe Salty documentation repository builds and deploys the docs.saltbox.dev website
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact…
CVE-2026-110130Critical· 10.0PoCDockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open fo…
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open fo…
CVE-2026-109157Critical· 9.9PoCA vulnerability was found in TRENDnet TEW-432BRP 3.10B20
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer over…
CVE-2026-109110Critical· 10.0PoCA flaw has been found in Wavlink WL-WN592AX6 250422
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The explo…
CVE-2026-103849Critical· 10.0PoCAdobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or…
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or…
CVE-2026-53709Critical· 9.8PoCMCP Context Forge is an MCP gateway and administrative platform
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user()…
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2026-104935Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commandskev, exploited, zero_day90
- CVE-2026-78835Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.severity, cvss66
- CVE-2026-52394DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.severity, cvss62
- CVE-2024-34323ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameterseverity, cvss55
- CVE-2026-76285Improper Adherence to Coding Standardsseverity, cvss54
Most-affected vendors
By CVEs published in the period.