Daily digest
Sunday 25 October 2026
A quiet day: only 139 new CVEs against a recent average of about 593. Of those, 8 critical and 29 high. 18 arrived with exploitation evidence or public exploit code already attached. Red Hat was the most-affected vendor with 18.
New this day, ranked by depth score
The 12 that matter most of the 139 published.
MAL-2026-18300Critical⚠ ExploitedMalicious code in claudeopusenifile (PyPI)
Malicious code in claudeopusenifile (PyPI)
MAL-2026-18299Critical⚠ ExploitedMalicious code in claudeopuseni (PyPI)
Malicious code in claudeopuseni (PyPI)
MAL-2026-18298Critical⚠ ExploitedMalicious code in claudeopusfile (PyPI)
Malicious code in claudeopusfile (PyPI)
MAL-2026-18297Critical⚠ ExploitedMalicious code in nebulallm (PyPI)
Malicious code in nebulallm (PyPI)
MAL-2026-18296Critical⚠ ExploitedMalicious code in zagents-message-bus (PyPI)
Malicious code in zagents-message-bus (PyPI)
MAL-2026-18271Critical⚠ ExploitedMalicious code in fontus (PyPI)
Malicious code in fontus (PyPI)
CVE-2026-116067High· 8.2PoCPaisa before 0.7.8 Path Traversal via Editor and Sheet API
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. At…
CVE-2026-115214Critical· 9.8Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authent…
CVE-2026-116191High· 7.5PoCRclone before 1.75.2 Path Traversal via serve webdav MKCOL
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS …
CVE-2026-116060High· 7.3PoCSourceCodester Performance Indicator System adddealer.php sql injection
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact can lead to sql injection. The attac…
CVE-2026-116049High· 7.3PoCkrupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql injection
A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file /source/registerform2.php of the component Registration Wizard. …
CVE-2026-116006High· 7.3PoCYunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication
A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile…
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
- CVE-2026-105134A flaw has been found in Ahsay AhsayCBS up to 10.3.2epss96
- CVE-2026-76460A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpointepss93
- CVE-2026-110447Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208kev78
- CVE-2026-28318SolarWinds Serv-U Unauthenticated Denial of Service Vulnerabilityepss75
- CVE-2026-114612LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Keyexploit_available67
Most-affected vendors
By CVEs published in the period.