Weekly digest
Week 42, 2026 (12–18 Oct)
A heavy week: 5,564 new CVEs, well above the recent average of about 2,828. Severity skewed high: 402 critical and 2,370 high, 50% of the total. 963 arrived with exploitation evidence or public exploit code already attached. CISA added 9 CVEs to the Known Exploited Vulnerabilities catalog. 3 CVEs saw exploit probability (EPSS) jump by ten points or more. Microsoft was the most-affected vendor with 1,437.
Added to CISA KEV
Confirmed exploitation in the wild — federal remediation deadlines attach to these.
CVE-2026-21589Critical· 9.3CISA KEVPoCThis is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerabili…
CVE-2026-105134Critical· 10.0CISA KEVPoCA flaw has been found in Ahsay AhsayCBS up to 10.3.2
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to…
CVE-2026-104935High· 8.6CISA KEV0dayPoCAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
CVE-2026-105133High· 7.3CISA KEVPoCA vulnerability was detected in Ahsay AhsayCBS up to 10.3.2
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in impr…
CVE-2026-102764Critical· 9.3CISA KEV0dayPoCImproper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to p…
CVE-2026-76519Critical· 9.8CISA KEV0dayPoCA vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to i…
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to i…
CVE-2026-96951High· 8.8CISA KEV0dayPoCImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-0322High· 7.2CISA KEV0dayPoCA remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The s…
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The s…
CVE-2025-61624Medium· 6.0CISA KEVPoCAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.…
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.…
Rising exploit probability
Largest EPSS increases inside the period (≥ 10 points).
- CVE-2026-43284High· 8.8In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb2.5% → 94%
- CVE-2026-93616Critical· 9.8A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.20% → 76%
- CVE-2026-85102Critical· 9.8Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.7.5% → 50%
New this week, ranked by depth score
The 12 that matter most of the 5564 published.
CVE-2026-104935High· 8.6CISA KEV0dayPoCAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
CVE-2026-102764Critical· 9.3CISA KEV0dayPoCImproper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to p…
CVE-2026-76519Critical· 9.8CISA KEV0dayPoCA vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to i…
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to i…
CVE-2026-110447Critical· 9.2CISA KEVPoCCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an O…
CVE-2026-96951High· 8.8CISA KEV0dayPoCImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-59774Critical· 9.8PoCGitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files acces…
MAL-2026-17921Critical⚠ ExploitedMalicious code in leakdeep (PyPI)
Malicious code in leakdeep (PyPI)
MAL-2026-17920Critical⚠ ExploitedMalicious code in voltswannts (PyPI)
Malicious code in voltswannts (PyPI)
MAL-2026-17919Critical⚠ ExploitedMalicious code in ukraine69 (PyPI)
Malicious code in ukraine69 (PyPI)
MAL-2026-17918Critical⚠ ExploitedMalicious code in tonemaptts (PyPI)
Malicious code in tonemaptts (PyPI)
MAL-2026-17917Critical⚠ ExploitedMalicious code in quasitonnts (PyPI)
Malicious code in quasitonnts (PyPI)
MAL-2026-17916Critical⚠ ExploitedMalicious code in pyrechoasr (PyPI)
Malicious code in pyrechoasr (PyPI)
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
- CVE-2026-0322A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The s…kev, exploited, zero_day, severity, cvss, exploit_available65
- CVE-2026-110144Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local programseverity, cvss47
- CVE-2026-104935Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commandskev, exploited, zero_day, exploit_available, epss90
- CVE-2026-102764Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Supportexploited, exploit_available, kev, zero_day80
- CVE-2026-76519A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to i…kev, exploited, zero_day, exploit_available79
Most-affected vendors
By CVEs published in the period.