Daily digest
Saturday 24 October 2026
A quiet day: only 76 new CVEs against a recent average of about 644. Of those, 11 critical and 22 high. 6 arrived with exploitation evidence or public exploit code already attached. CervantesSec was the most-affected vendor with 4.
New this day, ranked by depth score
The 12 that matter most of the 76 published.
CVE-2026-112866Critical· 9.3PoCWordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a throug…
CVE-2026-114820Critical· 9.1PoCVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2,…
CVE-2026-94075Critical· 9.8WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
CVE-2026-115933Critical· 9.9Forged signed tokens let any registered user take over other users and organizations
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request…
CVE-2026-115806Critical· 9.8Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUn…
CVE-2026-114196Critical· 9.8WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.
CVE-2026-110956Critical· 9.8asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, …
CVE-2026-116011High· 7.5PoCCrow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of …
CVE-2026-115995Critical· 9.6Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads …
CVE-2026-115932Critical· 9.6Path traversal in post media lets any registered user read server files
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a …
CVE-2026-115557Critical· 9.4Distrust compromised intermediate certificates in ssl module
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLC…
CVE-2026-111402Critical· 9.3WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2026-91403Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)severity, cvss62
- CVE-2026-109618RCE via OOM corruptionseverity, cvss, epss96
- CVE-2026-109619RCE via stale global stateseverity, cvss96
- CVE-2026-114625Security Advisory 0199kev, zero_day80
- CVE-2026-114612LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Keyseverity, cvss67
Most-affected vendors
By CVEs published in the period.