Daily digest
Thursday 29 October 2026
A quiet day: only 37 new CVEs against a recent average of about 490. Severity skewed high: 6 critical and 13 high, 51% of the total. 7 arrived with exploitation evidence or public exploit code already attached. keycloak was the most-affected vendor with 4.
New this day, ranked by depth score
The 12 that matter most of the 37 published.
MAL-2026-18403Critical⚠ ExploitedMalicious code in twitter-request-diagnostics (PyPI)
Malicious code in twitter-request-diagnostics (PyPI)
MAL-2026-18402Critical⚠ ExploitedMalicious code in test-01-rafamarrara-learning-dc (PyPI)
Malicious code in test-01-rafamarrara-learning-dc (PyPI)
MAL-2026-18396Critical⚠ ExploitedMalicious code in bq-helix-recon-6ade983e (PyPI)
Malicious code in bq-helix-recon-6ade983e (PyPI)
MAL-2026-18395Critical⚠ ExploitedMalicious code in bq-helix-build-hook-6ade983e (PyPI)
Malicious code in bq-helix-build-hook-6ade983e (PyPI)
MAL-2026-18378Critical⚠ ExploitedMalicious code in poc-revshell (PyPI)
Malicious code in poc-revshell (PyPI)
MAL-2026-17880Critical⚠ ExploitedMalicious code in seapy-ops (PyPI)
Malicious code in seapy-ops (PyPI)
CVE-2026-9086High· 7.3PoCKeycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
RUSTSEC-2026-0427High· 8.8`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)
`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)
GHSA-w9x9-j56r-h98rHigh· 8.2@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
RUSTSEC-2026-0419High· 7.5Unbounded memory use on large request bodies
Unbounded memory use on large request bodies
GHSA-vpp8-g58w-m8mpHigh· 7.5Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset
CVE-2026-63414HighShopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
- CVE-2014-6407Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.cvss42
- CVE-2026-96644Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)cvss, exploit_available57
- CVE-2026-116173vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassi…severity, cvss41
- CVE-2026-116178vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inc…severity, cvss41
- CVE-2026-116171SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefixseverity, cvss24
- CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoderepss92
Most-affected vendors
By CVEs published in the period.