Daily digest · in progress
Tuesday 27 October 2026
578 new CVEs this day, in line with the recent average so far. Of those, 55 critical and 156 high. 6 arrived with exploitation evidence or public exploit code already attached. Mozilla was the most-affected vendor with 174.
New this day, ranked by depth score
The 12 that matter most of the 578 published.
MAL-2026-18343Critical⚠ ExploitedMalicious code in numprint (PyPI)
Malicious code in numprint (PyPI)
MAL-2026-18336Critical⚠ ExploitedMalicious code in h13t0ry-hello-demo (PyPI)
Malicious code in h13t0ry-hello-demo (PyPI)
CVE-2026-114612Critical· 9.9PoCLiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
CVE-2026-65145Critical· 10.0NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue
NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information…
CVE-2026-105781Critical· 10.0Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attack…
CVE-2026-92885Critical· 9.8Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login
The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typograph…
CVE-2026-86574Critical· 9.8Heap-based Buffer Overflow Vulnerability in JP1/Base
Heap-based Buffer Overflow Vulnerability in JP1/Base. This issue affects JP1/Base: from 11-00 before 12-50-54.
CVE-2026-82120Critical· 9.8Heap-based Buffer Overflow Vulnerability in HiRDB
Heap-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00…
CVE-2026-82119Critical· 9.8OS Command Injection Vulnerability in HiRDB
OS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 throu…
CVE-2026-82118Critical· 9.8Stack-based Buffer Overflow Vulnerability in HiRDB
Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-0…
CVE-2026-82117Critical· 9.8Authentication Bypass by Spoofing Vulnerability in HiRDB
Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from…
CVE-2026-82116Critical· 9.8Missing Authentication for Critical Function Vulnerability in HiRDB
Missing Authentication for Critical Function Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Ver…
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2026-109618RCE via OOM corruptionepss, severity, cvss, kev, exploited96
- CVE-2026-109619RCE via stale global stateepss, severity, cvss, kev, exploited96
- CVE-2026-114612LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Keycvss, severity67
- CVE-2026-13043A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary p…severity, cvss60
- CVE-2024-58239In the Linux kernel, the following vulnerability has been resolved: tls: stop recv() if initial process_rx_list gave us non-DATA If we have a non-DATA record on the rx_list and another record of the same type still on the queue, we wil…severity, cvss57
Most-affected vendors
By CVEs published in the period.