Daily digest
Saturday 17 October 2026
A quiet day: only 103 new CVEs against a recent average of about 739. Of those, 12 critical and 29 high. 37 arrived with exploitation evidence or public exploit code already attached. thorsten was the most-affected vendor with 28.
New this day, ranked by depth score
The 12 that matter most of the 103 published.
MAL-2026-17920Critical⚠ ExploitedMalicious code in voltswannts (PyPI)
Malicious code in voltswannts (PyPI)
MAL-2026-17919Critical⚠ ExploitedMalicious code in ukraine69 (PyPI)
Malicious code in ukraine69 (PyPI)
MAL-2026-17918Critical⚠ ExploitedMalicious code in tonemaptts (PyPI)
Malicious code in tonemaptts (PyPI)
MAL-2026-17917Critical⚠ ExploitedMalicious code in quasitonnts (PyPI)
Malicious code in quasitonnts (PyPI)
MAL-2026-17916Critical⚠ ExploitedMalicious code in pyrechoasr (PyPI)
Malicious code in pyrechoasr (PyPI)
MAL-2026-17915Critical⚠ ExploitedMalicious code in novalithtts (PyPI)
Malicious code in novalithtts (PyPI)
MAL-2026-17914Critical⚠ ExploitedMalicious code in glassbeakasr (PyPI)
Malicious code in glassbeakasr (PyPI)
MAL-2026-17913Critical⚠ ExploitedMalicious code in emberlytts (PyPI)
Malicious code in emberlytts (PyPI)
MAL-2026-17912Critical⚠ ExploitedMalicious code in driftwavets (PyPI)
Malicious code in driftwavets (PyPI)
CVE-2026-111911Critical· 9.8PoCphpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, su…
CVE-2026-104736Critical· 9.8PoCLearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The va…
CVE-2026-111908High· 8.3PoCphpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify acces…
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
- CVE-2026-102764Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Supportkev, zero_day80
- CVE-2024-58239In the Linux kernel, the following vulnerability has been resolved: tls: stop recv() if initial process_rx_list gave us non-DATA If we have a non-DATA record on the rx_list and another record of the same type still on the queue, we wil…severity, cvss57
- CVE-2026-31525bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MINseverity, cvss55
- CVE-2023-53116In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid potential UAF in nvmet_req_complete() An nvme target ->queue_response() operation implementation may free the request passed as argumentseverity, cvss54
- CVE-2023-53517In the Linux kernel, the following vulnerability has been resolved: tipc: do not update mtu if msg_max is too small in mtu negotiation When doing link mtu negotiation, a malicious peer may send Activate msg with a very small mtu, e.gseverity, cvss54
Most-affected vendors
By CVEs published in the period.