Daily digest
Wednesday 21 October 2026
579 new CVEs this day, in line with the recent average. Of those, 59 critical and 197 high. 89 arrived with exploitation evidence or public exploit code already attached. Apache Software Foundation was the most-affected vendor with 69.
New this day, ranked by depth score
The 12 that matter most of the 579 published.
CVE-2026-109619Critical· 9.2CISA KEVPoCRCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after i…
CVE-2026-109618Critical· 9.2CISA KEVPoCRCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performin…
CVE-2026-111183Critical· 9.80dayGStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required …
CVE-2026-92208High· 8.80dayPoCNoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability
NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to explo…
CVE-2026-92207High· 8.80dayMindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability. …
CVE-2026-92206High· 8.80dayCrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability
CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to…
MAL-2026-18151Critical⚠ ExploitedMalicious code in zennittts (PyPI)
Malicious code in zennittts (PyPI)
MAL-2026-18150Critical⚠ ExploitedMalicious code in voxilaratts (PyPI)
Malicious code in voxilaratts (PyPI)
MAL-2026-18149Critical⚠ ExploitedMalicious code in vellutts (PyPI)
Malicious code in vellutts (PyPI)
MAL-2026-18148Critical⚠ ExploitedMalicious code in tessivatts (PyPI)
Malicious code in tessivatts (PyPI)
MAL-2026-18147Critical⚠ ExploitedMalicious code in solivoxtts (PyPI)
Malicious code in solivoxtts (PyPI)
MAL-2026-18146Critical⚠ ExploitedMalicious code in shellgrip (PyPI)
Malicious code in shellgrip (PyPI)
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2026-89686nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revokeseverity, cvss54
- CVE-2026-89702nfsd: size fh_verify server sockaddr slot by xpt_locallenseverity, cvss54
- CVE-2026-113116Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML pageseverity, cvss53
- CVE-2026-113010Out of bounds read in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML pageseverity, cvss, exploit_available48
- CVE-2026-89682nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_netseverity, cvss45
Most-affected vendors
By CVEs published in the period.