Weekly digest
Week 41, 2026 (5–11 Oct)
A busier-than-usual week with 3,349 new CVEs (recent average about 2,683). Of those, 382 critical and 1,252 high. 580 arrived with exploitation evidence or public exploit code already attached. CISA added 5 CVEs to the Known Exploited Vulnerabilities catalog. 4 CVEs saw exploit probability (EPSS) jump by ten points or more. Google was the most-affected vendor with 282.
Added to CISA KEV
Confirmed exploitation in the wild — federal remediation deadlines attach to these.
CVE-2015-3306Critical· 10.0CISA KEVPoCThe mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
CVE-2016-3081High· 8.1CISA KEVPoCApache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVE-2015-5477High· 7.5CISA KEVPoCnamed in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
CVE-2021-3199Critical· 9.8CISA KEVPoCDirectory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
CVE-2023-22894Medium· 4.9CISA KEVPoC⚖ disputedStrapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from …
Rising exploit probability
Largest EPSS increases inside the period (≥ 10 points).
- CVE-2026-73570High· 8.9A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled12% → 72%
- CVE-2026-55040Critical· 9.1Microsoft SharePoint Server Security Feature Bypass Vulnerability18% → 70%
- CVE-2026-66066CriticalAction Pack is a framework for handling and responding to web requests2.1% → 28%
- CVE-2021-3199Critical· 9.8Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.8.2% → 19%
New this week, ranked by depth score
The 12 that matter most of the 3349 published.
CVE-2026-21589Critical· 9.3CISA KEVPoCThis is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerabili…
MAL-2026-17757Critical⚠ ExploitedMalicious code in webreader (PyPI)
Malicious code in webreader (PyPI)
MAL-2026-17756Critical⚠ ExploitedMalicious code in pafer (PyPI)
Malicious code in pafer (PyPI)
MAL-2026-17755Critical⚠ ExploitedMalicious code in agent-vx (PyPI)
Malicious code in agent-vx (PyPI)
MAL-2026-17753Critical⚠ ExploitedMalicious code in media-manager5 (PyPI)
Malicious code in media-manager5 (PyPI)
MAL-2026-17752Critical⚠ ExploitedMalicious code in agentaix (PyPI)
Malicious code in agentaix (PyPI)
MAL-2026-17807Critical⚠ ExploitedMalicious code in py2ops (PyPI)
Malicious code in py2ops (PyPI)
MAL-2026-17713Critical⚠ ExploitedMalicious code in sharpnes (crates.io)
Malicious code in sharpnes (crates.io)
MAL-2026-17712Critical⚠ ExploitedMalicious code in ig-gox (PyPI)
Malicious code in ig-gox (PyPI)
MAL-2026-17703Critical⚠ ExploitedMalicious code in kafka-roller (PyPI)
Malicious code in kafka-roller (PyPI)
MAL-2026-17702Critical⚠ ExploitedMalicious code in kafka-helmsman (PyPI)
Malicious code in kafka-helmsman (PyPI)
MAL-2026-17639Critical⚠ ExploitedMalicious code in lore-cs (PyPI)
Malicious code in lore-cs (PyPI)
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
- CVE-2026-51886langflow-ai langflow v1.9.3 is affected by: Code Injectionseverity, cvss, exploit_available66
- CVE-2026-104711Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Strutsseverity, cvss66
- CVE-2026-56857On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the rootseverity, cvss54
- CVE-2026-94205Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request authorseverity, cvss54
- CVE-2023-22894Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filterseverity, cvss, exploited, kev53
Most-affected vendors
By CVEs published in the period.