VulnSea

Daily digest

Thursday 22 October 2026

507 new CVEs this day, in line with the recent average. Of those, 90 critical and 154 high. 46 arrived with exploitation evidence or public exploit code already attached. Drupal was the most-affected vendor with 72.

507
New CVEs
90
Critical
0
KEV additions
206
Records changed

New this day, ranked by depth score

The 12 that matter most of the 507 published.

CVE-2026-114625Critical· 9.9CISA KEV0dayPoC
5d ago

Security Advisory 0199

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integ…

▾ HadalArista Networks · VeloCloud OrchestratorEPSS 1.0%via CVEORG
CVE-2026-111497Critical· 9.2PoC
5d ago

Out-of-Bounds Write in Google Brotli Decoder

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive m…

▾ AbyssalGoogle · github.com/google/brotliEPSS 55%via CVEORG
MAL-2026-18203Critical⚠ Exploited
5d ago

Malicious code in journey-teste-shellhello (PyPI)

Malicious code in journey-teste-shellhello (PyPI)

▾ Abyssaljourney-teste-shellhello · journey-teste-shellhellovia OSV
MAL-2026-18189Critical⚠ Exploited
5d ago

Malicious code in aanthropic (PyPI)

Malicious code in aanthropic (PyPI)

▾ Abyssalaanthropic · aanthropicvia OSV
MAL-2026-18188Critical⚠ Exploited
5d ago

Malicious code in 1h1 (PyPI)

Malicious code in 1h1 (PyPI)

▾ Abyssal1h1 · 1h1via OSV
MAL-2026-18176Critical⚠ Exploited
5d ago

Malicious code in voxweaver (PyPI)

Malicious code in voxweaver (PyPI)

▾ Abyssalvoxweaver · voxweavervia OSV
MAL-2026-18175Critical⚠ Exploited
5d ago

Malicious code in voicekit (PyPI)

Malicious code in voicekit (PyPI)

▾ Abyssalvoicekit · voicekitvia OSV
MAL-2026-18174Critical⚠ Exploited
5d ago

Malicious code in vocabblend (PyPI)

Malicious code in vocabblend (PyPI)

▾ Abyssalvocabblend · vocabblendvia OSV
MAL-2026-18173Critical⚠ Exploited
5d ago

Malicious code in vocabbench (PyPI)

Malicious code in vocabbench (PyPI)

▾ Abyssalvocabbench · vocabbenchvia OSV
MAL-2026-18172Critical⚠ Exploited
5d ago

Malicious code in ttsweaver (PyPI)

Malicious code in ttsweaver (PyPI)

▾ Abyssalttsweaver · ttsweavervia OSV
MAL-2026-18171Critical⚠ Exploited
5d ago

Malicious code in ttsprobe (PyPI)

Malicious code in ttsprobe (PyPI)

▾ Abyssalttsprobe · ttsprobevia OSV
MAL-2026-18170Critical⚠ Exploited
5d ago

Malicious code in ttsflow (PyPI)

Malicious code in ttsflow (PyPI)

▾ Abyssalttsflow · ttsflowvia OSV

Most-changed records

Existing CVEs whose severity, score, KEV or exploitation status moved.

  • CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalization56
  • CVE-2014-6407Arbitrary Code Execution in Docker41
  • CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods45
  • CVE-2026-112940filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process over…51
  • CVE-2025-55654A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.42
  • CVE-2026-107081SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management Sys…66
  • CVE-2026-109444OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection66
  • CVE-2026-77930EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents66

Most-affected vendors

By CVEs published in the period.