Daily digest
Friday 16 October 2026
486 new CVEs this day, in line with the recent average. Of those, 47 critical and 167 high. 146 arrived with exploitation evidence or public exploit code already attached. CISA added 2 CVEs to the Known Exploited Vulnerabilities catalog. Red Hat was the most-affected vendor with 36.
Added to CISA KEV
Confirmed exploitation in the wild — federal remediation deadlines attach to these.
CVE-2026-102764Critical· 9.3CISA KEV0dayPoCImproper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to p…
CVE-2025-61624Medium· 6.0CISA KEVPoCAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.…
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.…
New this day, ranked by depth score
The 12 that matter most of the 486 published.
MAL-2026-17900Critical⚠ ExploitedMalicious code in marocolor (PyPI)
Malicious code in marocolor (PyPI)
MAL-2026-17897Critical⚠ ExploitedMalicious code in fromthehotel-poems (PyPI)
Malicious code in fromthehotel-poems (PyPI)
MAL-2026-17866Critical⚠ ExploitedMalicious code in pyyi (PyPI)
Malicious code in pyyi (PyPI)
CVE-2026-94169Critical· 10.0PoCImproper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
CVE-2026-95182Critical· 10.0PoCAn untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.
CVE-2026-89079Critical· 9.8PoCTheme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their passw…
CVE-2026-111823Critical· 9.8PoCMage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
CVE-2026-111708Critical· 9.8PoCWhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to …
CVE-2026-111704Critical· 9.8PoCLangChat through commit 2a6285a Missing Authentication on REST API Controllers
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users…
CVE-2026-111693Critical· 9.8PoCDataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credent…
CVE-2026-111692Critical· 9.8PoCDataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of…
CVE-2026-111690Critical· 9.8PoCSimple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign …
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2026-95182An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.severity, cvss, exploit_available67
- CVE-2026-88755Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.severity, cvss, exploit_available55
- CVE-2026-111381FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parsercvss, exploit_available52
- CVE-2026-18807The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level ac…severity, cvss, exploit_available36
- CVE-2026-102764Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Supportexploited, exploit_available80
Most-affected vendors
By CVEs published in the period.