Week 41, 2026

5–11 October 2026

New CVEs: 3,238
Critical: 361
High: 1,191
Newly exploited: 8
Advisories: 828
Malicious pkgs: 301

Newly exploited 8

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.1
CVE-2026-40478 ENISA Oct 10, 2026 Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
thymeleaf · thymeleaf · org.thymeleaf:thymeleaf-spring5 · org.thymeleaf:thymeleaf-spring6

EPSS 1.1%
Critical 9.1
CVE-2026-40477 ENISA Oct 10, 2026 Improper restriction of the scope of accessible objects in Thymeleaf expressions
thymeleaf · thymeleaf · org.thymeleaf:thymeleaf-spring6 · org.thymeleaf:thymeleaf-spring5
Critical 9.0
CVE-2026-41901 ENISA Oct 10, 2026 Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions
thymeleaf · thymeleaf
Critical 10.0
CVE-2015-3306 KEV Oct 8, 2026 The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
EPSS 99%
Critical 9.8
CVE-2021-3199 KEV Oct 8, 2026 Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an imag…
EPSS 30%
High 8.1
CVE-2016-3081 KEV Oct 8, 2026 Apache Struts RCE Vulnerability
EPSS 97%
High 7.5
CVE-2015-5477 KEV Oct 8, 2026 named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon ex…
EPSS 100%
High 7.2
CVE-2023-22894 KEV Oct 8, 2026 Strapi leaking sensitive user information by filtering on private fields
EPSS 4.1%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.3
CVE-2026-21589 This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. C…
Atlassian · Confluence Data Center · Jira Service Management Data Center · Bitbucket Data Center

EPSS 100%
Critical 9.8
CVE-2026-93674 Langflow OSS is affected by multiple vulnerabilities
IBM · Langflow OSS

EPSS 15%
Critical 9.4
CVE-2025-64393 This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
Veeam · Backup and Replication

EPSS 5.2%
Critical 9.8
CVE-2026-76268 Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
Splunk · Splunk Enterprise

EPSS 4.8%
Critical 10.0
CVE-2026-108576 TOZED X300 IPPingDiagnostics process_ping os command injection
TOZED · X300

EPSS 4.1%
Critical 9.9
CVE-2026-105740 Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server
langflow-ai · langflow

EPSS 3.9%
Critical 9.8
CVE-2026-76455 Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities
Cisco · Cisco NX-OS Software · Cisco Unified Computing System (Managed) · Cisco NX-OS System Software in ACI Mode

EPSS 3.6%
Critical 9.8
CVE-2026-85097 Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
Bricksforge · Bricksforge

EPSS 3.3%
Critical 9.8
CVE-2026-105110 Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter
Iskratel · Innbox

EPSS 3%
Critical 9.9
CVE-2026-106126 Command Injection
Tenable · Tenable Identity Exposure (SaaS)

EPSS 2.2%
Critical 10.0
CVE-2026-105484 TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection
Totolink · X6000R

EPSS 2.1%
Critical 9.8
CVE-2026-107780 Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter
dromara · skyeye

EPSS 2.1%
Critical 9.8
CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format
jtescher · image_optimizer

EPSS 2%
Critical 9.6
CVE-2026-91140 OS command injection in Progress Software Autonomous REST Connector GenAI Agents
Progress Software · Autonomous REST Connector GenAI Agents

EPSS 2%
Critical 9.5
CVE-2026-107406 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
NetScaler · ADC · Gateway

EPSS 1.9%

All 361 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

USN-8888-2 linux-azure-7.0, linux-azure-fde-7.0 vulnerabilities 1151 CVEs
USN-8888-1 linux-azure, linux-azure-fde vulnerabilities 1151 CVEs
USN-8887-3 linux-gcp-7.0, linux-hwe-7.0, linux-oracle-7.0 vulnerabilities 1050 CVEs
USN-8887-2 linux-aws-7.0 vulnerabilities 1050 CVEs
USN-8887-1 linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-oracle, linux-realtime vulnerabilities 1050 CVEs
USN-8889-1 linux-oem-7.0 vulnerabilities 1049 CVEs
USN-8878-1 linux-gcp-5.15 vulnerabilities 973 CVEs
USN-8879-1 linux-oracle-5.15 vulnerabilities 972 CVEs
USN-8877-1 linux-gcp, linux-gcp-fips vulnerabilities 952 CVEs
USN-8875-2 linux-nvidia vulnerabilities 951 CVEs