Daily digest
Monday 26 October 2026
A busier-than-usual day with 767 new CVEs (recent average about 597). Of those, 30 critical and 115 high. 33 arrived with exploitation evidence or public exploit code already attached. CISA added 2 CVEs to the Known Exploited Vulnerabilities catalog. Apple was the most-affected vendor with 324.
Added to CISA KEV
Confirmed exploitation in the wild — federal remediation deadlines attach to these.
CVE-2026-109619Critical· 9.2CISA KEVPoCRCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after i…
CVE-2026-109618Critical· 9.2CISA KEVPoCRCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performin…
New this day, ranked by depth score
The 12 that matter most of the 767 published.
MAL-2026-18328Critical⚠ ExploitedMalicious code in netweavex (PyPI)
Malicious code in netweavex (PyPI)
MAL-2026-18327Critical⚠ ExploitedMalicious code in zagents-framework (PyPI)
Malicious code in zagents-framework (PyPI)
MAL-2026-18326Critical⚠ ExploitedMalicious code in changes-lxc-wrapper (PyPI)
Malicious code in changes-lxc-wrapper (PyPI)
MAL-2026-18301Critical⚠ ExploitedMalicious code in dictmerge-lite (PyPI)
Malicious code in dictmerge-lite (PyPI)
CVE-2026-116504Critical· 9.9PoCTOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection
A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads…
CVE-2026-116232Critical· 9.9PoCOray Pugongying X5 Pro SNMP snmp_set crlf injection
A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launc…
CVE-2026-115905Critical· 10.0PoCzip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames …
CVE-2026-116485Critical· 9.8PoCdanmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST req…
CVE-2026-107092Critical· 9.8PoCNexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
CVE-2026-116235Critical· 9.1PoCOray Pugongying X5 Pro L2TP Authentication crlf injection
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be i…
CVE-2026-112345High· 8.1PoCTTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure
TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BL…
CVE-2026-116508Critical· 10.0TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument …
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
- CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoderepss, severity, cvss74
- CVE-2026-116180vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensorsseverity, cvss42
- CVE-2026-52356An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.severity, cvss, exploit_available61
- CVE-2025-69723A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL.severity, cvss, exploit_available46
- CVE-2025-55640A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.severity, cvss, exploit_available42
Most-affected vendors
By CVEs published in the period.